In Firefox for OpenBSD support for filesystem isolation using a system call . The necessary patches have already been accepted upstream and will be included in Firefox 72.
Firefox on OpenBSD has been previously secured using to limit access for each type of process (main, content, and GPU) to system calls, and now access to the filesystem will also be restricted for them using unveil(). , access is limited to the directories ~/Downloads and /tmp; both when downloading files from the internet and when accessing files from the disk. The pledge() and unveil() settings are stored in files in /usr/local/lib/firefox/browser/defaults/preferences/, the contents of which can be overridden in files from /etc/firefox/. The advantage of the second option is that only root can edit these files.
Similar capabilities have previously been implemented in the Chromium and Iridium browsers.
Source: opennet.ru
