It can also download and execute arbitrary javascript from the web, outside of a normal browser sandbox, effectively turning every app into a potential vector for system takeover, because it is RCE by design.