Look at how often V8’s sandboxes get exploited. It’s all developed by humans, which means there will always be errors.
Saying just make airtight sandboxes is like just write bug-free code.
Saying just make airtight sandboxes is like just write bug-free code.
JavaScript is not machine code, but still a good deal harder to make fast than a language designed for fast sandboxing. Of course there have been bugs, but mostly I think the JS VMs have done a pretty good job of protecting browsers.