Hacker News Reader

There used to be dozens of them at any given time; maybe they're a bit rarer now that cloud providers have been banging on them for a while.

There's a huge difference. Browser sandboxes are not "real" VMs and share a kernel. And in case of Chromium it's enough to read a few bytes from another process (token) to escape.

Can you elaborate on that? What do tokens have to do with breaking out of a sandbox?

Yes, I should have added that I'm referring specifically to the scenario OP is suggesting, which would require a host <-> client IPC channel, opening up the VM to similar attack vectors to a sandbox.