You are aware that millions of people use web browsers each day to do their banking, purchase products, and generally run businesses?

Are terminals better sandboxed when run outside of a browser?

Usually yes. They are running in a completely different process than the browser.

Don't be ridiculous. The only and obvious answer to the question is "no" -- the terminal itself and all commands inside it run unimpeded.

A malicious website would have a hard time capturing (or injecting) info an OS terminal running on an entirely different process than it would on a browser with imperfect context separation.

You clearly misunderstood the issue.

Running in the browser is no more (or less) untrusted than running a dedicated terminal client.

That a terminal in the browser can't make ssh connections without a separate http or websocket bridge complicates that. Depends on that bridge and who/how/where it's running.

When was the last case when a malicious website or script could capture content or keystrokes directed at another tab? Really curious, because it seems an obvious attack vector.

2018 at the earliest:

https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...

It's not a browser vulnerability per se, but it's still mitigated by having a separate address space.

At least in the last decade, I don’t think that’s even possible on the “big” browsers. There were vulnerabilities involving <iframe>s, but I don’t know enough about those.

Of course it is. In most cases you do not have any sort of guarantees regarding the browser (which it self usually is more complex piece of software than all your operating system and it's accessories calculated together - difficult to audit - known to collect metrics etc etc). In addition one can sandbox their local terminal pretty effectively - With Tomoyo or some other MAC technology. It's not so bad idea to actually isolate your browser too (with Mandatory Access Control) - It usually has no business for a global view on your filesystem or local network resources.

I tend to disagree. The fact, that a browser engine and JS is involved raises the bar significantly during security audits. It brings additional third-party players into the chain you have to trust. Meanwhile I suggest to read https://xtermjs.org/docs/guides/security/.