16

4.3M Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign

The builtin JavaScript interpreter is such a devious touch. No one blinks an eye at several MBs of extension data. That’s plenty of room to store arbitrary runtimes in, and then all the default browser runtime protections are pointless.