Isn't SELinux supposed to provide exactly this functionality?

The tricky part are the profiles afaik. But this could be solved with some concentrated community effort I guess.

I think AppArmor does something similar (I don't know the differences to SELinux in detail, so if someone like to clarify please go ahead). I remember I've seen some AppArmor related stuff regarding Firefox (and LibreOffice I think) in Ubuntu. So seems not much is missing to have at least an sandboxed web browser out-of-the-box on a Linux desktop.