@simon Thank you!

Re the new boundary question: The issue is that in-the-wild attacks are able to construct exploit chains that first compromise the content process using JavaScript engine bugs and next escalate privileges by either

- using a bug in the browser host process' communication interface, where a missing check allows a compromised content process (which is generally quite locked down) to compromise the host process (which has little/no restrictions) merely by passing it a bad message

- using a bug in the OS kernel/drivers to directly get root

Here is one of many examples i quickly looked up from google project zero

https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2019/CVE-2019-11707.html

The easiest way to cut this is of is at step 1, i.e., isolate the effect of JavaScript engine bugs, so that step 2 is not possible