[taway1237]

There's a huge difference. Browser sandboxes are not "real" VMs and share a kernel. And in case of Chromium it's enough to read a few bytes from another process (token) to escape.

[nolist_policy]

Can you elaborate on that? What do tokens have to do with breaking out of a sandbox?