Comment by pcwalton

In case it wasn't clear, it is now the case that content process compromise is no longer critical unless combined with sandbox escape.

Looking at historical vulnerability reports can be misleading in this regard, as the sandboxing features are rather recent (pre-stable-version in some cases).