It's changing rapidly. Until recently, Firefox did have a sandbox, but lots of different origins lived together in the same sandbox. Which made it much less use

It's changing rapidly. Until recently, Firefox did have a sandbox, but lots of different origins lived together in the same sandbox. Which made it much less useful for many types of attacks. Since Fission (shipping now-ish?), each origin lives in its own sandboxed process—same as Chrome—so on the surface there's no longer any difference. That said, sandboxes aren't all or nothing, and my impression is that the chromium sandbox is still tighter than Firefox's. (I work for Mozilla, but not on sandboxing, and I'm not in touch with the current state.) That is improving over time, and Firefox already has some types of sandboxing that are ahead of Chrome's. The main threat model here is malware, probably malware being served to you through an ad network. Run an ad blocker. Personally, I defend the principle of an ad-funded Web. But not the current practice. As long as ads are in practice an exploit vector, screw 'em.