i would be skeptical with your comment instead, because I think it has no basis in reality. you did not really say anything concrete about why you think so.

its not even about the permissions, but the API capabilities, and restrictions on background operations. web APIs provide much less access to the operating system than the OS APIs allow, even when given all the permissions. a webapp can’t read all your pictures, can’t access your contacts or SMS messages, because there are no APIs that would allow that.

there are some more intrusive APIs in the web standards that are not really useful for other purposes than misusing them for user data collection, like the battery statistics API or the gyroscope API. but as you see, choosing a browser that respects your privacy will cover that, because while chrome implements it, firefox does not