We've identified 15,579 websites that are currently infected with malicious JavaScript and between them, we conservatively estimate that they receive more than 135 million visits every month.
We know they're infected, and we have the evidence to back that up, but there's a problem: how on
And this, right here, is why I don’t permit the execution of javascript by default.
Even here:
https://github.com/LemmyNet/lemmy-ui/issues/1895
Lemmy instances with custom emojis allow malicious Javascript
https://nvd.nist.gov/vuln/detail/cve-2026-54743
NoScript has returned to my Firefox this year
Too much of the Web just doesn’t work with browsers without Javascript on for me to do that these days.
There was a time when I did browse like that.
Wise. Personally, I prefer umatrix since that allows me more fine grained control and has the ability to selectively block other resources or types of requests too, but anything is better than letting every website one visits run reams of arbitrary code.