Hejto.pl
If an attacker observes two or three consecutive outputs of Math.random(), they can reverse-engineer the internal state - Deykun - Hejto.pl