Firefox to Get an Additional Sandbox Layer

The Firefox web browser already runs on top of a sandbox which separates the browser from the operating system. But with attack vectors growing more and more sophisticated (and many shared libraries not up to modern security demands), the Mozilla developers decided it was time to take the isolation of the browser further.

With the release of Firefox 74, a new sandbox technology, called RLBox, will be added. RLBox was developed as a joint effort between Mozilla, the University of California San Diego, the University of Texas at Austin, and Stanford University. 

According to Bobby Holley, principle engineer with Mozilla, RLBox is a “big deal”. With this new sandbox layer, it’s easy to isolate existing chunks of code at an unheard of granularity. With RLBox in place, the Firefox developers are able to separate third-party libraries from the Firefox core engine. By making this separation, bugs and exploits within third-party libraries will be unable to impact other applications that use the same library. 

The team involved with RLBox managed to isolate half a dozen libraries. Initially, Firefox will ship with the Graphite font shaping library, which is used to correctly render complex fonts, protected with RLBox. Eventually the same sandboxing technique will be applied more broadly to ensure browsing with the open source tool is as secure as possible.

Original source: https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/