> Note that people still find sandbox escapes against Chrome anyway. Yes, sometimes they use the OS, but due to how the sandboxing works that's to be expected.

> Note that people still find sandbox escapes against Chrome anyway. Yes, sometimes they use the OS, but due to how the sandboxing works that's to be expected. Google developed special architecture to make browser safer. Other vendors did nothing, they just wait until exploit becomes public and patch the code (and yet they call their product "secure"). Google also motivated Microsoft to allow disabling potentially vulnerable kernel library. Google since long ago has their own PDF viewer (so people don't have to use Adobe viewer) and their own Flash plugin. As a result on contests like pwn2own exploits for Chrome are the most expensive. Regarding Tor I am not sure if JS is really necessary for a secure network. You don't need it to read sites like wikileaks bit it provides a large attack surface and it might be better to have it disabled by default.