Currently, I am still building my own fork of WebKit (RetroKit [1] ) that removes all attack surfaces it still has (e.g. canvas, webgl, webaudio, applet and embed support, pdf plugins...you name it).
I realized at some point that all bridge concepts are super buggy, in Gecko, in WebKit, in Blink...and the only way to reduce the attack surface is to remove the featureset.
Tried to do the same with chromium and gecko before...but arguably both projects come with so much overhead (repo tools, hardcoded git urls everywhere, custom clone scripts for each platform and environment etc) that they're inforkable.
Take a look at projects like nwjs, where the maintainer has to go almost insane trying to keep up to date with upstream...and he basically didn't change anything else than the public headers to be able to embed chromium more easily.
I don't need WebGL to browse websites. If I want to visit a web experiment I can still use ungoogled chromium --user-data-dir=/tmp/...
As for the alternative in the meantime: I'm using ungoogled chromium with my own Browser Extension [2] to block off all tracking and filtering/rewriting the actual content.
[1] Still WIP. Would love to get more people on board: https://github.com/tholian-network/retrokit