Embed Notice

@farooqkz the security features are named pledge and unveil, the first restricts system calls the process can do, the latter restricts filesystem access.

Chromium and Firefox received both on OpenBSD, they are limited in term of system calls (not really visible for the end user), but also in term of filesystem, they can write in the directory ~/Downloads/ and read a ton of other directories useful for the runtime (settings, fonts, shared libraries etc...), nothing more.

FreeBSD has an equivalent named capsicum but they did not implement it into web browsers (checked a few months ago).

Linux has sandboxing using multiple methods:

- web browsers installed with snap or flatpak are sandboxed
- web browsers started with firejail are sandboxed