But the thing is that if I were to build a browser, I'd start from the requirement that websites should be treated like malware that can't be trusted. Applying my ideas to a preexisting enormous codebase feels troublesome.