Revisiting Browser Security in the Modern Era: New Data-only Attacks and Defenses