We need a viewport-size-agnostic graphical native sandbox that works on x86_64 and ARM, and can be reasonably sure is escape-proof. Which is hard to do if you let it have multitasking and access to graphics drivers.

Then we need a means of letting it have just enough network access to be useful but not enough to exploit the rest of your system, bearing in mind the discussion of WebRTC going on at the moment.