Firefox to Get an Additional Sandbox Layer

Mar 06, 2020

Starting with Firefox 74, the open source web browser will include the new RLBox security feature.

The Firefox web browser already runs on top of a sandbox which separates the browser from the operating system. But with attack vectors growing more and more sophisticated (and many shared libraries not up to modern security demands), the Mozilla developers decided it was time to take the isolation of the browser further.

With the release of Firefox 74, a new sandbox technology, called RLBox, will be added. RLBox was developed as a joint effort between Mozilla, the University of California San Diego, the University of Texas at Austin, and Stanford University. 

According to Bobby Holley, principle engineer with Mozilla, RLBox is a “big deal”. With this new sandbox layer, it’s easy to isolate existing chunks of code at an unheard of granularity. With RLBox in place, the Firefox developers are able to separate third-party libraries from the Firefox core engine. By making this separation, bugs and exploits within third-party libraries will be unable to impact other applications that use the same library. 

The team involved with RLBox managed to isolate half a dozen libraries. Initially, Firefox will ship with the Graphite font shaping library, which is used to correctly render complex fonts, protected with RLBox. Eventually the same sandboxing technique will be applied more broadly to ensure browsing with the open source tool is as secure as possible.

Original source: https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/

Related content

  • NEWS

    In the news: Zorin OS 15.2 Now Available; Firefox to Get an Additional Sandbox Layer; Microsoft Defender ATP is Coming to Linux; South Korean Government Considers Move to Linux Desktop; OpenSSH Now Supports FIDO/U2F Security Keys; and System76 Launches New AMD Threadripper Machine.

  • Firefox in Transition

    What’s new in Firefox 57 Quantum – and why does it matter so much?

  • Mozilla Announces new Firefox API

    Future Firefox extensions will be compatible with Chrome.

  • Mozilla Releases Firefox 3.6.4, Complete with Crash Protection

    Linux users don't have to worry about third-party plugins killing the browser.

  • Browser Cleanup

    Web browsers collect a large amount of data about the user’s browsing habits. If you care about privacy, you might want to clean up your browser and configure some custom privacy settings.

comments powered by Disqus

Issue 240/2020

Buy this issue as a PDF

Digital Issue: Price $12.99
(incl. VAT)

News