I wonder if they could use firecracker or something to reboot the browser (and nuke persistent/ephemeral storage) on each page load. They could even bounce each user across all their hosts by default.

For trusted sites (ones the user logged into), this could be disabled.