Note: this does not answer my question as it mentions Java/Flash(not in the modern context. The question is from like 10 years ago so probably outdated), and mentions weakness introduced by the user(whereas I'm asking exploits that can be used by code along. No user action is considered.)
I recently was faced with this question: in the modern context(2023, that is), with the latest version of Chrome or Firefox and the latest web standard, how safe am I from web pages with malignant intent? This is NOT about protecting my information from phishing or scamming, not about how I should not enter my info into unknown websites, etc., but about what harm could client-side web code do, if I just open random web pages and let their client-side code run? I'm not downloading anything or entering ANY information. Just opening the webpage and using it normally.
I thought about this, and it's obvious that a site cannot access cookies of other sites, so no data-mining there. It cannot access my file system, cannot download files or execute shell commands, so no worries getting viruses too if I don't get tricked into downloading manually. It seems like the very best they could do is gather my IP address and somehow profit from that, other than that they're powerless to do anything. (Back in the days they could annoy me with infinite pop-ups, but even that is banned by chrome now...)
Note that all these are in the modern context, where Chrome/Firefox offers excellent protection, and Flash is long dead. Considering all possible occurrences in the modern world, what are there?
So, if I give you the chance to write any code in a webpage and I'd just open it, what max harm could you do to me, if you really wanted to? (Data-collection, break my computer, anything really.)