@dtl@8bitorbust.info I just keep a copy of debian-chromium around and launch it with --temp-profile (which IIRC is a debian wrapper feature, it creates a new profile directory in /tmp before launching) for that stuff. But I'm also annoyed by it, hence the temptation to do the native-shim thing. The idea is to utilize the native-RPC mechanism there to allow extensions to talk to native apps, but have an "app" whose sole purpose is to expose the WebUSB API over that RPC channel. The extension handles all the permission prompts, and the 'app' handles all the device restrictions (no "sensitive" device classes, mainly). The native side could also in theory be implemented in a way that allows its use as a portal by flatpak and friends for accessing specific USB device types via manifest permission, too (as an explicit dbus portal and/or a "libUSB compatible" drop-in shim, like pipewire-pulse)