The work on Arbitrary Code Guard sounds valuable, and hopefully much of the research[1] done by Google Project Zero is being taken on board. That said, as some

The work on Arbitrary Code Guard sounds valuable, and hopefully much of the research[1] done by Google Project Zero is being taken on board. That said, as someone with a defender / website maintainer mindset, statements like this make me blink for a few seconds before staring wistfully into the middle distance: > One way to balance user security and reduce impact is to bypass security protections for frequently visited sites. Really? And how will I know when a user reports an issue (security-related or otherwise) whether the problem was because their browser hadn't been trained into having sufficient praise (on a score from 0 to 100) for the web server? [1] - https://googleprojectzero.blogspot.com/2018/05/bypassing-mitigations-by-attacking-jit.html https://googleprojectzero.blogspot.com/2018/05/bypassing-mit...