For people convinced that X is irreparably insecure, I would direct you to the implementation in Qubes.<p>On Qubes, a secure management environment runs as a VM called dom0 on Xen, a hypervisor. dom0 (or, on the upcoming 4.1 release, another VM) runs a Linux and manages the physical display and input devices, and an X server that only it connects to, for desktop operations. User-level applications are always run in other VMs that have no direct access to hardware. Each such appVM runs its own X server, headless. So, the only programs that talk to the physical X server are desktop widgets like the XFCE "panel". appVMs have no access to those.<p>When an app opens a window in its X server, a memory mapping is provided shared with dom0. The app's X server writes its pixels into that shared memory, and dom0 copies from that shared memory to a corresponding window on the physical display. dom0 delivers input events to an appVM's X when they occur within a window the appVM controls.<p>Importantly, each appVM has no access to any other appVM's X server, window contents, or the GPU, or input; everything it does other than making and deleting windows is via raw bits copied in memory without interpretation. Thus, appVMs are wholly isolated from one another except via (virtual) network routing.<p>You may object that this would make interaction very slow and laggy. Perhaps surprisingly, it does not, at least on modern hardware, and when running non-time-critical programs. Certainly, browsers (including youtube pages) and similar programs -- wireshark, transmission-gtk, gitk, evince, system-config-printer -- work fine. Even mpv does fine with movies at 2880x1620 resolution. (4K is just out of reach, on my 5y-old laptop.)<p>I don't know what the brave new world of Wayland will look like on Qubes. The same, I expect. Ways to securely virtualize access to the GPU are, to my knowledge, still a research topic. Maybe Vulkan operations can be forwarded safely? Each shader's memory would need to be protected from others', or operations sequenced with mappings swapped in and out.