This list has lots of potential ECMAScript vulnerabilities: http://code.google.com/p/google-caja/wiki/AttackVectors My superficial understanding of "use strict" makes me think that some of these are non-issues, but more research is needed to verify.