So you might like Qubes OS, which isolates all apps into hardware-assisted VMs. You will still have all the access from the AdminVM, but arbitrary processes won't.

I am using Qubes already ;^)

So you've got nothing to worry about except things like this: https://forum.qubes-os.org/t/qsb-116-multiple-xen-issues-xsa...