It's not accurate to say that Firefox has no sandbox. Sandboxing work has been rolling out for many months now, and later versions have increasingly restrictive sandboxes. You can see the current status per version here: https://wiki.mozilla.org/Security/Sandbox#Current_Status

Hardening the sandbox is a constant work in progress, but it's not as simple as "compromise of browser engine automatically means arbitrary code execution as running user" any longer.

When it is there I would definitely use it along with Chrome.

Looking at historical vulnerability reports can be misleading in this regard, as the sandboxing features are rather recent (pre-stable-version in some cases).

In terms of security architecture, there is to my knowledge only one bigger difference left and you can change that, if you want.

The difference is that Chrome will spawn a new process for every new tab (unless the webpage in it is from the same domain as another tab). Firefox instead will always round-robin the tabs across a fixed number of processes to achieve lower RAM usage and as result of that also somewhat better performance.

But you can tell Firefox to round-robin across up to 1000 processes or what have you, so that it then does spawn a new process for every new tab (and therefore sandboxes each tab individually).

To do so, go into about:config and set "dom.ipc.processCount" to a high number, like 1000.

https://v8project.blogspot.ro/2016/10/fall-cleaning-optimizi...

Also is using thread per tab approach more susceptible to memory leaks, resource sharing issues or OS scheduling shenanigans than process per tab approach? You close the tab, the process is dead and resources are mostly guaranteed to returned. My knowledge of modern browsers is limited, maybe this was considered an acceptable compromise though.