The browser executes foreign Javascript (or tries to), which may be injected through ads or other sources. Really old systems may be hit by domain squatting, where the original domain has come under new ownership. Fingerprinting allows malicious code to target specific systems, to stay largely undetected.
A NAT won't protect you if it is your browser issuing the request. If malicious code gets into your system, it can use STUN to facilitate direct connections between NAT systems, building botnets.
As soon as you assume being behind a NAT, only visiting perfectly secure and well-maintained websites, and browsers which never go anywhere else on their own, you are probably fine. Systems too old to be usable (such as DOS or early Windows machines or early Macintoshes) are also fine, as they fail to execute malicious code. Although the 16-bit versions of Internet Explorer and especially Outlook Express on Windows 3.1 were accidentally weaponized; their parsing and scripting engines were largely compatible with their 32-bit counterparts.
A NAT won't protect you if it is your browser issuing the request. If malicious code gets into your system, it can use STUN to facilitate direct connections between NAT systems, building botnets.
As soon as you assume being behind a NAT, only visiting perfectly secure and well-maintained websites, and browsers which never go anywhere else on their own, you are probably fine. Systems too old to be usable (such as DOS or early Windows machines or early Macintoshes) are also fine, as they fail to execute malicious code. Although the 16-bit versions of Internet Explorer and especially Outlook Express on Windows 3.1 were accidentally weaponized; their parsing and scripting engines were largely compatible with their 32-bit counterparts.
