How Can JavaScript Be Malicious?

[da peppester]

Honesty, I am at a complete loss of how JavaScript could possibly be malicious. I mean, it seems like such a well sand-boxed language that I don't understand how code could be malicious. So, I guess what I am looking for is if there are any good examples of old JavaScript malware (that, obviously, has been patched because no sane person would work out a new way for JavaScript to be malicious and give it away for free).

[orangepeel367]

Some people say that Java cant be malicious (I am fully aware that Java and JavaScript have absolutely NOTHING in common) but people have written malware in Java. Cant pretty much any language be used to create malware?

[kevinkjt2000]

One example that comes readily to my mind: https://en.wikipedia.org/wiki/Cross-site_scripting

[da peppester]

Yes, in theory probably any language could be malicious, but the reason i'm focused on JavaScript is because that is where most-everyone's attention is centered at for exploiting bugs to make malware because, as you know, it runs freely in a sort of sense because all currently discovered malicious things have been removed) on clients computers.

Thank you so much, that is an awesome perfect example, exactly what I was looking for. You are so incredibly helpful.

How about something more complicated like abusing the paging file?