Attackers can call console.log a few times to spawn any file they want or even silently install browser extensions, not to mention that they will be able to read and write the file system too. The possibilities for evilness are endless.

Tips on "Security Enhanced" Linux, using Fedora as an example