The main browser process treats the renderer as untrustworthy/potentially hostile. A compromised renderer is in the threat model.