Tharkun parent
Another good reason to use Firejail. You tell it which folders FF gets to access, and Bob's your uncle.
But if this is only leaking the directory you choose to download, Bob's already your uncle?
Issue is that people don't and don't want to choose a fresh/clean-enough directory every download.
It's easier to create a new user account and run firefox from it. Something like:
xhost +si:localuser:firefox && su - firefox -c 'DISPLAY=:0 HOME=/home/firefox firefox 2>/dev/null' && xhost -
Yeah, because that's a lot easier than just running "firejail firefox".. And does your snippet work on Wayland?