Windows S mode is sort of like this, it mostly only lets you install sandboxed apps from the store. But a lot of Windows security advisories (and from what I ca

Windows S mode is sort of like this, it mostly only lets you install sandboxed apps from the store. But a lot of Windows security advisories (and from what I can recall most browser sandbox escapes) are actually from random half-assed features tacked on to privileged Windows services that ship with the install, so I’m not sure how much it would help. The Windows architecture has never done a good job of limiting attack surface.