Yes i am using Yahoo email service in a browser.
Outlook is insecure, i don't use it.
1 year ago, i was infected with a virus , that did infectet my hdd,
wiped out the whole harddisk.
Quote: " Can JS even manipulate anything outside the browser? "
I use to play around with javascript and learn
the basic stuff, No there isnt a way for javascript
to work outside the browser other than downloading or
uploading files from a webserver, to , in this case a user
requesting a download or, doing a upload of files.
Javascript can even silent send small .bat files from
a host server to a user, even if the user did'nt do
any requesting downloading files. ( that what you
call payload virus!).
It is unclear, if a virus can infect a user's pc, just
by reading a email ( html emails!). ? email ?!.

Javascript can't read for example , a user's
root directory on his harddisk.
But javascript can transfer files "inbetween"
the host and the specific website, yahoo email ?!.