Personally, I consider “process-per-tab” a stability and not a security feature. It’s quite wasteful as far as system resources go and it is actually unnecessary security-wise (as you said, if you found a way to circumvent the same-origin policy then you can use it on iframes in your own tab rather than trying to “hack” other tabs). It would be sufficient to have two processes – one for the browser UI and one for the content pages, like what the Firefox Mobile team did. But even that only makes sense if the content process is actually sandboxed and cannot do anything dangerous on its own. And then you have to consider the quality of the sandbox – what if the content process sends fake user input to the browser UI process, will it be tricked into doing something bad? That’s a very hard problem actually and I’m all but certain that the Chrome team managed to solve it completely. But thinking in terms of checklists is certainly easier.