seccomp and Capsicum are both available to unprivileged processes, and intended to support extremely limited access for isolated processes.
we view this as a false-positive result: it is part of a carefully-managed interaction between browser components for the purpose of enabling compartmentalization.