Browsers themselves (even the free ones) have various issues:
https://trisquel.info/en/forum/web-browser
Browser extensions are based on JavaScript code. Perhaps there are other
parts of the browser itself which is JS (I don't know but I wouldn't be
surprised). JS itself is not dangerous but if you visit a website which runs
JS you really don't know what your CPU is executing (unless you dig into tons
of code all the time).
I think that if XHR is blocked, JS cannot steal info from your RAM and send
it to another host. Additionally if cookies are blocked JS cannot store a
'state' which can be transmitted via HTTP in following site navigation.
uMatrix is a great extension which helps to control all that.
