Unless there’s a sandbox escape, the worst it could do is use some extra CPU cycles and RAM. It’s not good at doing stuff like bitcoin mining because it’s event driven (much more like a page than a web worker). All the browsers are also very aggressive at killing them unless a page is open or you get a push notification.