At WWDC 2018, Apple highlighted that Safari now sandboxes the browser process (whereas it ran un-sandboxed previously). We should consider doing the same, as it may be a prerequisite for enabling the Mojave Hardened Runtime (issue 850193).

Obviously the browser is the highest-privilege process Chrome has, so any sandbox we put around it will be rather porous. But we still may be able to drop some ambient capabilities that it does not require.