Chrome does not load every website into its own process: it does a lot of cross-site process sharing, and often very large numbers of sites can end up in the same process. It also does not keep each website into only one process, so in practice if a lot of tabs exist for one process (whether malicious or vulnerable) you can be assured of an overlap as you can end up in every process.