Do you know of any proposals for browsers to directly use capabilities?

Servers can implement a strict capability model for server-side objects but the browser's granularity for a capability owner is almost useless.

To be fair, no popular operating system makes much of a distinction between the human operator, the operator's actions via I/O, the behavior of applications ostensibly started by the user, and various other automatically started software, so at least browsers provide the concept of a domain for separate ownership.