Exactly this. Vrchat had chromium for a while, but exploits got it removed. Itd be great if it was just a static browser engine, no Js, with a strong sandbox. So at most all that can be done is messing with the browsers runtime memory itself, not the system it's on.
It's been a few years, and I can't recall the specifics with certainty. It was a serious Chromium SVE that was unpatched in the middleware we were using.