A JavaScript engine executes JavaScript embedded in a web page or loaded from another URL. It runs alongside the rendering engine: while rendering builds and updates the Document Object Model (DOM), JavaScript can respond to user activity and change that DOM. This matters because modern web applications, including many single-page applications, place much of their client-side behavior in JavaScript. section 2.1 section 2.2
Executing internet-loaded code is a security risk. Browser JavaScript engines therefore run code in a sandbox: an isolated environment intended to let page code update a page without letting hostile code take over the host system. Modern browsers generally reinforce that isolation by running each web page in a separate process with limited permissions. section 2.2
Sandboxing blocks JavaScript from directly doing several high-risk things:
- Accessing arbitrary files on disk. section 2.2
- Interfering with or communicating with other operating-system processes. section 2.2
- Reading arbitrary operating-system memory locations. section 2.2
- Making arbitrary network calls. section 2.2
These limits do not make browser JavaScript useless. Its usual job is to wait for DOM changes or user actions—such as scrolling, clicking, or typing—and then update page elements, load data, or trigger navigation. Code that needs additional capabilities can use browser APIs when the browser grants permission. The key distinction is that page code does not receive unrestricted operating-system access merely because it runs in a browser. section 2.2
When a script runs
A script in a page is passed to the JavaScript engine for execution. An inline script normally executes immediately; an external script executes when it has loaded. Adding the defer attribute makes the browser wait until the DOM is finalized before executing it. This timing affects whether a script can safely work with page elements that the renderer has not finished constructing yet. section 2.2
Sandboxing is a defensive boundary, not an invitation to trust every script. Browser history includes plug-ins such as Adobe Flash, Microsoft ActiveX, and Java applets that circumvented sandbox protections and became significant security hazards. Keep the practical boundary clear: JavaScript can make a page interactive, while the browser controls access beyond that page through isolation, restrictions, and permissions. section 2.2
