My impression was that with the switch from (UI)Webview to WKWebKit the webview is put in a sandbox automatically. At least the rendering is now out-of-process. Do you know anything about that?
Well, WKWebKit is in fact sandboxed, on macOS, as per what is going on with Webkit2GTK+, I am less familiar, but the project is well aware and on top of all security vulnerabilities:
https://webkitgtk.org/security.html