Isolation of web browser FTW. Prevents all potential leaks. I can run flash , java, javascript, use applications that leak DNS in fifty different ways and be rooted and the attacker still can not get my real IP (although of course I don't do such dangerous things, at least there is a strong layer of protection even in worst case scenarios)