I'm one of the lead devs on the Chrome Windows sandbox, and I can assure you that what we do with Vista+ on the security front is leaps and bounds ahead of what we're stuck with on XP. DEP is unreliable and pretty worthless anyway without ASLR. You also don't have things like SEHOP or other memory mitigations that are the first line of defense between your system and the average stale pointer exploit against WebKit.

As for the sandbox itself, we run as "Untrusted" integrity level under Vista+, which buys a solid layer of defense on top the SID, rights, and job based sandboxing we do on XP. Our GPU process sandbox in particular (used for accelerated graphics) relies heavily on Vista+ integrity levels due to deficiencies in the Windows XP driver and graphics model. Then there's the fact that XP is lacking hundreds of security fixes that Microsoft has chosen not to backport.

Seriously, I've spent many weeks trying to wring every last bit of security I can out of XP, and I really do think that Chrome does the best anyone possibly could on that front. But in the end XP is just an OS that's far past its security expiration date, and running it at all means taking a big risk.