Browser security mechanisms such as site isolation, sandboxing, and restrictions on arbitrary code execution did not appear simultaneously. Their architecture was repeatedly reshaped by real attacks ranging from Flash exploits to Spectre, session theft, and malicious extensions.
Flash: how abandoning the plugin eliminated an entire attack class
In January 2015, a visitor to an ordinary website could be compromised through a malicious advertising banner. Flash allowed attackers to deliver exploits that bypassed many browser protections of the era. The subsequent decision by major vendors to deprecate and finally remove the plugin removed an entire category of drive-by attacks that had previously required only a single compromised advertisement.
Process separation, sandboxing, and other modern controls were introduced incrementally as each new attack class exposed weaknesses in the previous model. Spectre demonstrated that even hardware-level side channels could be abused across site boundaries, leading to stricter isolation between origins and additional timing-attack mitigations still present in current releases.
