Qubes OS (https://www.qubes-os.org/ https://www.qubes-os.org/) seems relevant: that sandboxes every application into its own VM. It's a hell of a brute-force ap

Qubes OS (https://www.qubes-os.org/ https://www.qubes-os.org/) seems relevant: that sandboxes every application into its own VM. It's a hell of a brute-force approach to application isolation, but I guess it's the most robust strategy available.