If I were a hacker and I wanted to play around, the first thing I would do is make a cp -a of /usr/bin/browser.launch to browser.launch.orig. Then I would make sure that my new browser could take an url as a command-line argument. I would then copy my new browser to /usr/bin/browser.launch and see if that worked. If that fails, maybe I would then do a strings browser.launch.orig | sort | less to see what that reveals. It seems to reveal a few things. I would guess there might be one or two dbus messages to catch. Something similar could probably be done with bookmark.launch.