What is laking the the capability to let applications act as kernels by themselves. It would be much easier if the browser could have its own private filesystem, system calls and users exported to child processes.
AFAIK, Plan9 does some of this (at leask the filesystem part).
Not an easy task, but maybe worth some more thought.