They still don't have isolated per-domain render processes... That means if I exploit any renderer, I can take all your cookies for online banking and your webmail.