For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL?
Notice: The user only does a click on the URL, no any subsequent operations on the phishing website.
This would be a "Drive-by" attack, where the simple act of visiting a website from an initial click allows for a successful hack of the client.
Usually escaping the sandbox, getting code execution and privilege escalation is the result of combining multiple flaws to result in the desired goal.
So, in theory in 2018 it was possible… also if you look at CVE Details website for Chrome, Edge, Firefox and Safari you'll see the stats for 2018's CVE in those browsers. Given that these are just the known vulnerabilities it seems likely that drive-by are still possible.
A single click on a malicious link could indeed be dangerous:
Not sure I would call this "phishing" though, but that's just semantics.