I see updates as being crucially important as all the system functionality is exposed as html/css/javascript. I'm also curious how/if they sandbox the device's

I see updates as being crucially important as all the system functionality is exposed as html/css/javascript. I'm also curious how/if they sandbox the device's browser and still keep within their proposed paradigms. Is a malicious website going to be able to exploit my system using XSS?