It was probably preemptive when it was written, but it's been borne out by the facts.<p>The only browser that is "super sandboxed" is Chrome, and nobody knows how effective the process security model in Chrome is going to end up being. The actual vulnerability appears to be a basic object lifespan problem in DOM handling code; in other words, this could happen to any browser.<p>After Chrome, the browser with the next most involved security model is IE with DEP, and, in fact, when DEP is enabled, the exploit doesn't work (that's no guarantee that it could never work, though).