Methods and devices for processing web content are disclosed. The method may include receiving a webpage with a browser and parsing the webpage with the browser to obtain subcomponents from the webpage. The browser identifies whether there is an indication that one or more subcomponents of the webpage are potentially malicious, and when there is an indication that the one or more subcomponents of the webpage are malicious, the browser loads the one or more of the subcomponents of the webpage in an auto-sandbox instance for isolated execution by the browser.