Chrome's flag for sandboxing plugins dates back to before the code was open-sourced: http://src.chromium.org/viewvc/chrome/trunk/src/chrome/commo... (search for "safe-plugins"). The reason it was never on by default for Flash is that you can't sandbox Flash without breaking Flash functionality. How did Firefox solve this problem?