General Discussion • Re: This might spawn THOUSANDS of vulnerabilities on Pale Moon (Or might not)

Am I correct in assuming that for any vulnerability, no matter how it was discovered, a potential attacker would still have to find a way to take over your machine, right? Before being able to exploit anything?

Not when it comes to a browser, because by design that is processing and displaying foreign content under control of an attacker. But there's a big difference between a potential vulnerability and a practical exploit that can be reached by crafting a site/document that triggers it when opened. But when it comes to a browser a prerequisite of having a compromised machine is not a thing. In fact it would be a way to compromise a machine, if nothing else.