Comment 42 for bug 1590561

"/sys/devices/pci[0-9]*/**/config r,"
Doesn't that give the browser access to all PCI devices? :)

It's just a graphics device issue so the right device should be:
/dev/dri/*

In theory Unity8 should be automatically assigning these rights to all GUI apps automatically. Not sure if it does. Certainly Mir won't do this for you. You may even find yourself sometimes in a situation where graphics appears to work, but because of missing access to /dev/dri/* Mesa will fall back to software rendering of OpenGL apps (which works well enough many people never realise it has happened).