only way I could see something going morris worm level these days would be if someone got the intel speculative execution bugs to work in javascript, and if they where hardcore malicious enough not to just use it to make a quiet background bitcoin miner and get stupid rich.