I browse the web on QubesOS in a disposable VM. There's no user data in the disposable VM, and all the data is cleared when the browser is turned off. Also, Qub

I browse the web on QubesOS in a disposable VM. There's no user data in the disposable VM, and all the data is cleared when the browser is turned off. Also, QubesOS allows me to run my GnuPG daemon in a separate domain completely isolated from all other applications. This is the ultimate defense against arbitrary code execution in a buggy web browser. To take over the computer, the attacker must exploit the Xen hypervisor or a CPU side-channel, not just a 0day in Firefox or a PDF reader. Yes, QubesOS's approach is not pretty, it's a hack and resource-heavy. But this hack allowed us to continue using an existing insecure desktop system, device drivers and applications, without reinventing the OS and the desktop with its set-back of non-existent support. At least it's a very practical stop-gap measure before someone reinvents OS security. A lightweight solution I used previously was running the browser in a separate Unix user with firejail's sandbox. If it's not running a separate X server, the attacker is free to take over the X server and inject keyboard and mouse inputs, but at least the files in the primary /home directory is inaccessible. I did this a few years ago after the disclosure of a file-leaking vulnerability in Firefox, because I assumed similar exploits may be discovered in the future, apparently I'm not wrong.