How dangerous can JavaScript be?

The reason NoScript even exists in the first place is not necessarily JavaScript per se, but security holes in the browser. In the past Firefox and other browsers have had many security vulnerabilities that have allowed malicious JavaScript to do bad things to a user's system. (In many cases native code could be executed through JavaScript, meaning a website could potentially do anything to your computer.) There is also a possibility of cross-site scripting attacks, like @Eric said.

However, these threats are very few and far between unless you regularly browse shady websites, so whether or not NoScript is worth the hassle is up to you. Personally, I don't find it to be worth it, especially considering that more and more websites require JavaScript to function at all, which means you will constantly be whitelisting scripts or entire domains (and at that point, you're defeating some of the benefit of using it in the first place).

See http://en.wikipedia.org/wiki/Cross-site_scripting and http://en.wikipedia.org/wiki/Cross-site_request_forgery for examples of how someone with malicious intent can cause problems using JavaScript.

FWIW - I personally don't roll with NoScript as I think it's a major headache. Sometimes you just have to watch where you're browsing and hope for the best.

• Poorly written or malicious JavaScript can crash your browser, or cause it to freeze up

• JavaScript may be used to cause drive-by downloads

• But, used properly and as intended, JavaScript does enhance the web browsing experience

There are pros and cons, but on the whole it is worth the trouble. For the record, I always use the NoScript extension, selectively enabling scripts for the sites I regularly visit and I expect are safe.