The JavaScript [`Math.random()`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/random) function is designed to return a single floating point value _n_ such that 0 ≤ _n_ < 1. It is (or at least should be) widely known that the output is _not_ cryptographically secure. Most modern implementations use the [XorShift128+](http://vigna.di.unimi.it/xorshift/) algorithm which can be [easily broken](https://security.stackexchange.com/q/84906/165253). As it is not at all uncommon for people to [mistakenly use it](https://medium.com/@betable/tifu-by-using-math-random-f1c308c4fd9d) when they need better randomness, why do browsers not replace it with a CSPRNG? I know that [Opera does that](https://lists.w3.org/Archives/Public/public-webcrypto/2013Jan/0063.html)\*, at least. The only reasoning I could think of would be that XorShift128+ is faster than a CSPRNG, but on modern (and even not so modern) computers, it would be trivial to output hundreds of megabytes per second using ChaCha8 or AES-CTR. These are often fast enough that a well-optimized implementation may be bottlenecked only by the system's memory speed. Even an unoptimized implementation of ChaCha20 is extremely fast on all architectures, and ChaCha8 is more than twice as fast.

I understand that it could not be re-defined as a CSPRNG as the standard explicitly gives no guarantee of suitability for cryptographic use, but there seems to be no downside to doing it anyway. It would reduce the impact of bugs in a large number of web applications without violating the standard (it only requires that the output be round-to-nearest-even  [IEEE 754](https://en.wikipedia.org/wiki/IEEE_754) floating point numbers), decreasing performance, or breaking compatibility with web applications.

<sub>\* As CodesInChaos points out, this is no longer true now that Opera uses [Blink](https://en.wikipedia.org/wiki/Blink_(web_engine)) from Chromium.</sub>