You don't want a browser with a bunch of RCEs that can be triggered by opening a web page...

You do want a browser with RCE, but you want it to keep the it sandboxed. The hard part is executing the code safely