> Inb4 security vuln in a builtin is used to pivot across tabs or reveal state in other tabs. Although I don't know all the internals of how chrome isolates ta

> Inb4 security vuln in a builtin is used to pivot across tabs or reveal state in other tabs. Although I don't know all the internals of how chrome isolates tabs, I'm not sure how that's supposed to happen. If I understand the original approach correctly, it just means that the code is in the original binary, paged in once and using copy-on-write semantics while forking individual sandbox processes only exists as a single copy instead of multiple copies that would happen if the code somehow has to be prepared by "copying to the JS heap" of each individual sandbox process.