The approach is helpful, perhaps not very practical (do I maintain N different browser installations in my qube for N different tasks, or is it a single installation where malware can therefore affect all qubes?). But remember that OS and libraries have plenty of bugs too.

I suppose that an OS running transparently on an actual cluster of many independent cores, not linked even by a common L2 cache, could allow to separate security domains much more reliably.

Single-thread performance would suffer, though, unless you're ready to pay quite a lot. And it's still hugely important in many cases.

There is a Linux scheduler option for cpuset accessible via cgroups iirc, that pins execution to a set of cores. I've not used it.