Browsing: kernel-enforced confinement