Sandbox

Renderer processes run with restricted privileges — no direct file or network access — so a compromised page can't touch your system. They ask the browser process to act on their behalf.

A page can't read your disk; it must ask the browser process through browser APIs.