(I can't convince myself whether this is or isn't a security issue, so I'm filing a bug to capture the discussion.)

The same DevTools process can attach to different renderer processes. For example, if you open DevTools, navigate to https://example.com, then navigate to https://google.com, the DevTools process stays the same even though the navigation was cross-process.

This seems non-ideal, especially in a site isolation world: if you attach DevTools to evil.com and evil.com can XSS DevTools, then that turns into a UXSS as long as DevTools is open.

OTOH, it's very convenient for DevTools to stay in the same process so that it can preserve console output, network logs, etc. across navigations.

cc'ing some people who might have opinions