Well you of course want to sub-divide every application in user space either with gvisor or a hypervisor, like QubesOS.

If someone pwns your personal browser they should pop out into an environment where nothing exists but that browser, with no idea the work browser is in a sibling vm.