Mostly plugins and shoddy code. But yeah, I wouldn't necessarily call it an 'inherent' problem, just a difficult one. I've often wondered if it were feasible to run every browser tab in a separate (fork()ed) and chrooted OS process as an unprivileged user. Browsers generally already run plugins in separate processes because they have a habit of crashing or deadlocking. What about distrusting major parts of the browser itself that way?