[unkown-unknowns]

Out of the box it'll probably tell you "Client is not authorized to connect to server" if you try to run anything X11 as another user.

However it should be possible to configure your system such that it doesn't like such: https://wiki.archlinux.org/index.php/xorg#X_clients_started_...

[pbhjpbhj]

I currently run my kids browsers under my user by doing "xhost +local:; su -l -c /usr/bin/firefox $USERNAME" where USERNAME is the kids login. I may have made changes to enable that, don't recall sorry.

[digi_owl]

An extra layer of protection may be offered by using the likes of xpra.

https://xpra.org/