Is a system vulnerable where the only untrusted code is interpreted, JIT'd, or executed in a VM as bytecode?
Does it depend on the language? Compiler?
Or, do attacks depend on the attacker loading very specific, compiled instructions onto the machine?
Is this because V8 and company generate specific machine instructions that can be carefully tailored? Are the vulnerabilities in the JITing? The VM's? Or can any Turing-complete language mount an attack? ... Where's the line?