This is great news. The old implementation was a little scary, they had a full JavaScript parsing engine (and other similar parsers) running as SYSTEM. You can

This is great news. The old implementation was a little scary, they had a full JavaScript parsing engine (and other similar parsers) running as SYSTEM. You can get a sense of it via this Project Zero bug report: https://bugs.chromium.org/p/project-zero/issues/detail?id=1252 https://bugs.chromium.org/p/project-zero/issues/detail?id=12... That specific bug and others were of course fixed. The issue is that such complex code is hard to write well in the language they're using, and running as SYSTEM is just asking for a zero day take over from simply visiting a site with a malicious file or an unread email. I hope other AV vendors follow suit on the component sandboxing. They're scanning untrusted files, who will happily try to crash or take-over the AV process itself.