The camera shows up with devices /dev/video2 and /dev/video3. Both have no world permissions and only have permissions for owner (root) and the group video. Adding my user to the video group fixed the problem:
usermod -a -G video USER
That doesn’t explain why Cheese worked fine, but both browsers now see the camera and offer it as an option.