I wouldn't say "a lot". Though the multi-process model Chrome uses and the V8 sandbox do provide a lot of security isolation (more than just running the browser in a VM). Though a lot of these protections are disabled on low-end mobile devices because of the associated overhead. Firefox has been making good progress implementing some of the same isolation mechanisms and is farther along rewriting components in Rust to avoid memory safety issues.