We currently use a shared temporary directory, shared by all content processes. After Fission, we want origins (sites?) to not be able to influence each other. So we should either: a) Make this directory per-content-process. b) Remove tempdir access entirely. This may be possible after WebGL and more font remoting.