Control groups are your friends. Run your browser in a separate control group with a constrained memory. It took me discovering memory leaks from qemu running X

Control groups are your friends. Run your browser in a separate control group with a constrained memory. It took me discovering memory leaks from qemu running X over virgl machines to actually spend a weekend figuring it out, but it is doable. * I run separate cgroups for admin SSH with (1G min, 4G max ) - worst case scenario I can ssh into the desktop and kill offending processes. * Separate cgroup for two browsers ( 8G each max ). * Separate cgroup per qemu VM ( VM max ram + 512M each max ). After implementing that I went from periodic lock ups to a quick browser crash and a restart maybe once a week.