The browser security model relies heavily on protection from things like process isolation, ASLR, etc though at this point browsers also implement their own def

The browser security model relies heavily on protection from things like process isolation, ASLR, etc though at this point browsers also implement their own defense in depth mechanisms on top. for example, jsc maintains separate heaps for each data type - referred to as cages, i think - so that it's hard to perform type confusion attacks. but there are entire classes of attacks that would be viable against browsers if not for the tools they get from the kernel like ACLs, page protections, ASLR, control flow guard, etc. When one part of the stack of protections fails, you can see things like persistent root on chromebooks where that one hole is used as a springboard to attack other vulnerabilities: https://news.ycombinator.com/item?id=15713103 https://news.ycombinator.com/item?id=15713103