The real power comes from the scriptability and integration with JavaScript, though. We are sure lots of people will find uses for the ability to embed any document LibreOffice can open into any web page, control and automate it from JavaScript, with the choice of a full local user interface – or none, just the content, controlled with a JavaScript UI instead. The code is all under the MIT licence, so it's all-FOSS, and all the work is being upstreamed to LibreOffice itself.
I'm guessing this might introduce a lot of new attack vectors?