And the Flatpak browser thing is complicated.

Chromium uses namespaces. Nowadays unprivileged user namespaces, but the legacy suid namespaces are still integrated.

If you want to run Chromium (and I think all Electron apps too) as Flatpak, you replace those namespaces with zypak, which instead isolates processes using flatpak and its seccomp filters.

These are the seccomp filters for every app though, so they are probably way too unrestricted. Also it has a small performance hit.

That is the reason why no Chromium Browser Flatpak is official.

Now the thing with Firefox is, I have no idea what isolation they use. Everyone says its less secure. And they adopted Flatpak as if it was nothing, without any comment on that topic.

The issue is that Flatpak uses a single seccomp filter for bubblewrap, that is used by every app. But browsers would need a different one, with just the added permission to create user namespaces.

Currently this is not even possible when using a seperate repo. Really, no idea. Bubblejail is an alternative with custom seccomp filters and usernamespace permission. But it is very different, uses system packages and is very alpha.