> if they don’t consider it safe for process multitenancy, which they have every incentive to do, it’s not safe. It's more nuanced than that. Unfortunately sec

> if they don’t consider it safe for process multitenancy, which they have every incentive to do, it’s not safe. It's more nuanced than that. Unfortunately security is not a boolean thing, where it's either secure or it's not secure. V8 is designed to be a secure sandbox on its own. But security is actually about risk management. V8 is complicated, and it has bugs. It tends to have more bugs than a typical hypervisor does. So it's more risky to rely on it as a secure sandbox, unless you can find risk mitigations to layer on top of it. After a decade of relying on V8 alone to isolate frames from each other (within a tab), Chrome chose to add strict process isolation as a second security layer. But Chrome definitely doesn't think of that second layer as being the "secure" one -- security comes from having both together, so an attack has to bypass both at the same time. Google still pays big bug bounties for V8 breakouts.