Don't think of it like, "I need to protect against hacking" think of it like, "I need to make sure processes cannot control each other unless explicitly allowed

Don't think of it like, "I need to protect against hacking" think of it like, "I need to make sure processes cannot control each other unless explicitly allowed to do so." Hypothetical: A vulnerability in Chrome could allow a remote attacker the ability to read/write arbitrary files on your filesystem. /tmp/.X11-unix/X0 for example. This could let them cause all sorts of havoc on your X11 display including controlling/compromising other running programs (and capturing your keystrokes). If Chrome were sandboxed as described in the article such an attack would not be possible without first breaking out of the sandbox.