It never is just a button: concerns when running code in someone else's computer

— "There was a button", Holden said. "I pushed it."
— Jesus Christ. That really is how you go through life, isn't it?

Introduction

Ever since JavaScript was introduced, we have had concerns with security issues leading to the current patchwork of rules, headers and sandbox that browsers have had to implement reactively. After billions of dollars invested, we have billions of devices running the best sandbox ever which is Chromium's V8. But will that ever be enough? Will this cat and mouse game ever end? If not, why?