When a user clicks a link in a phishing email, the browser is exploited first, gaining code execution in the browser process; modern browsers have sandboxing, but the attacker must achieve sandbox escape and then privilege escalation to reach kernel-level execution, at which point defenses on the host essentially fail