well the solution is sandboxed temporary runtime environment with user controlled session duration, user managed permissions and strong profile siloes, also known as: your browser.
They aren’t application they extend the environment on which the untrusted application run, as such they’re more like kernel modules in regard of security and threat modelling
