They also come with a web browser that runs a full coding language, javascript.

The operating system is supposed treat end-applications like games and browsers as untrusted and provide isolation against them. The real kicker here is the bug in the `fs` service.