If you use GNOME:
- disable thumbnails, it parses all files and has been exploited before
- disable search, every keystroke gets sent to dozens of programs
- disable tracker, it indexes all files and has been exploited before
- disable all extensions, they can do absolutely anything
- especially user extensions as those are automatically updated every started and could be hijacked
- use wayland, to ensure some isolation
- use the latest version
my brace sets most of these