Someone with access to any unencrypted HTTP stream - think ISP or wifi-sharer or (especially) government or cybercriminal - can slip in javascript that, in one browser window, gives the attacker the information needed to decrypt the secure streams in other browser windows.
They do not need to find an exploit in your browser to jump from an insecure browser session to your secure sandbox beside it.
How would they jump sandboxes? Wouldn't that require a browser-specific attack? For example, how would some injected code on HN jump over to my secure banking tab, in another chrome process?
Presumably the injected code creates specially crafted requests to the SSL site being attacked - it can't read the results of those requests, but that doesn't matter: its only purpose is to create some adaptively-chosen known plaintext for the sniffer.
No, it wouldn't. With AJAX, the request always goes out, and is received and processed by the server if they choose to (most never check the request origin).
Then, the server can decide whether or not to attach cross origin resource sharing headers to the response. If those headers exist, the response is exposed to JavaScript. If not, they are swallowed by the browser.
In the case of Chrome (and other browsers are moving in the same direction), you should be able to check the pid of the instance you're dealing with. At least, I assume that's the case if they're offering native c++ support.
Someone with access to any unencrypted HTTP stream - think ISP or wifi-sharer or (especially) government or cybercriminal - can slip in javascript that, in one browser window, gives the attacker the information needed to decrypt the secure streams in other browser windows.
They do not need to find an exploit in your browser to jump from an insecure browser session to your secure sandbox beside it.