It sounds impossible to make this browser secure. They're allowing Java and NPAPI plugins as an explicit compatibility goal.

Granted, security isn't a stated goal here. XP users unfortunately can't expect that anymore.

Are there any modern HTML5-compliant browsers that support XP anymore?

Firefox still supports XP SP2 and Vista.

What's privacy in the absence of security? Last I checked, there is no ASLR support for Windows XP. You really do not want to run something with Chromes attack surface on it.