A denial of service bug in the engine’s JavaScript interpreter could allow an attacker to turn off protection.