I don't agree -- process isolation is a simple, effective, and traditional mechanism. It has downsides (e.g. parsing and serializing), but they don't apply her

I don't agree -- process isolation is a simple, effective, and traditional mechanism. It has downsides (e.g. parsing and serializing), but they don't apply here. Many mitigations work at the process level, like ASLR, cgroups, and more. There's a reason that Chrome doesn't allow parsing and rendering in the same process: https://www.chromium.org/developers/design-documents/multi-process-architecture/ https://www.chromium.org/developers/design-documents/multi-p... Something like the rule of 2 should apply to the sshd -> xzutils dependency -- it's inherently dangerous. https://chromium.googlesource.com/chromium/src/+/master/docs/security/rule-of-2.md https://chromium.googlesource.com/chromium/src/+/master/docs... Note that Firefox spent years of engineering effort to catch up with Chrome, retrofitting a multiprocess architecture. Multiprocess architecture is demonstrably more secure, e.g. if you look at all the actual exploits from https://en.wikipedia.org/wiki/Pwn2Own https://en.wikipedia.org/wiki/Pwn2Own