diff --git a/sandbox/policy/mac/renderer.sb b/sandbox/policy/mac/renderer.sb
index 0000000..0000001 100644
--- a/sandbox/policy/mac/renderer.sb
+++ b/sandbox/policy/mac/renderer.sb
@@ -5,10 +5,14 @@
 ; --- The contents of common.sb implicitly included here. ---

 ; Put the denials first.
-; crbug.com/799149: These operations are allowed by default.
+; crbug.com/799149: Some operations are not children of `default` in the
+; seatbelt operation tree on all macOS versions and must be denied explicitly.
+; distributed-notification-post is denied so that the mach-lookup grant for
+; com.apple.distributed_notifications@Uv3 below cannot be used to broadcast
+; spoofed notifications (e.g. com.apple.screenIsLocked) to the browser process.
 (if (param-true? disable-sandbox-denial-logging)
-  (deny iokit-get-properties process-info* nvram* (with no-log))
-  (deny iokit-get-properties process-info* nvram*)
+  (deny iokit-get-properties process-info* nvram* distributed-notification-post (with no-log))
+  (deny iokit-get-properties process-info* nvram* distributed-notification-post)
 )

 ; Allow cf prefs to work.