Re:Sandboxed Mac apps can record screen any time without you...
by cesnja on Sunday February 11, 2018 @12:49PM
(#16353728)
You can run the browser process in a separate mount namespace, only allowing it to access, for example, downloads folder, while everything else is off limits. I recommend Firejail.
So the benefits of the easier sandboxing provided by Wayland are somewhat overstated, at least for typical Linux users.