the Java and Flash approach was software-implemented security contexts and managers, running the VM in the same process as the browser. People used to say that

the Java and Flash approach was software-implemented security contexts and managers, running the VM in the same process as the browser. People used to say that you couldn't do strong process isolation because it would be unworkably slow. And then Google Chrome demonstrated that was a falacy. People actually flocked to chrome because it was faster, despite it using multiple processes and isolating plugins. NaCL built on that - it's security model was strong process isolation and verification that the code run in that isolated process couldn't 'escape'. Mozilla is still kinda in denial re process isolation.