Once an exploit allows running arbitrary code in a sandboxed browser process, NT kernel syscalls become relevant even if your computer isn’t otherwise infected.

Once an exploit allows running arbitrary code in a sandboxed browser process, NT kernel syscalls become relevant even if your computer isn’t otherwise infected. See project zero for a rundown of NT kernel vulnerabilities actually exploited from sandboxed processes (Firefox uses the same sandbox as Chrome on Windows): https://googleprojectzero.blogspot.com/2021/01/in-wild-series-windows-exploits.html https://googleprojectzero.blogspot.com/2021/01/in-wild-serie... .