Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them. Basically they restrict browser capabilitie

Firejail on GNU/Linux, Capsicum on FreeBSD etc do something for that, and IMO any tech-savvy users should use them. Basically they restrict browser capabilities to see entire filesystem to the minimum extent possible so an webappp can't download from you your personal ssh settings, plain-text saved passwords in home, secret porn collection etc.