I expect the software I use to properly sanitise untrusted inputs, yes
Sure, but still, why blame (only) the browser?
Sure, but still, why blame (only) the browser?