Browsers rarely need direct read and write access to your entire home directory. Sandboxing them with Firejail restricts access to sensitive folders.
Firejail includes robust default profiles for popular browsers like Firefox, Brave, and Chromium.
To ensure the browser is always launched inside Firejail without typing it manually each time, symlink the Firejail executable ahead of the browser binary in
/usr/local/bin:
sudo ln -s /usr/bin/firejail /usr/local/bin/brave-browser
Because
/usr/local/bin takes precedence in your $PATH, any external link clicks or terminal commands will automatically run inside the Firejail sandbox.
