Still nothing can solidly run arbitrary code from internets, be it flash, java applets, javascript or even webp and web fonts.