Securing Firefox with WebAssembly - Mozilla Hacks - the Web developer blog https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/
Mozilla Hacks - the Web developer blogSecuring Firefox with WebAssembly – Mozilla Hacks - the Web developer blog
うわ、これ冴えてるな
[2003.00572] Retrofitting Fine Grain Isolation in the Firefox Renderer (Extended Version) https://arxiv.org/abs/2003.00572
arxiv.orgRetrofitting Fine Grain Isolation in the Firefox Renderer (Extended Version)Firefox and other major browsers rely on dozens of third-party libraries to
render audio, video, images, and other content. These libraries are a frequent
source of vulnerabilities. To mitigate this threat, we are migrating Firefox to
an architecture that isolates these libraries in lightweight sandboxes,
dramatically reducing the impact of a compromise.
Retrofitting isolation can be labor-intensive, very prone to security bugs,
and requires critical attention to performance. To help, we developed RLBox, a
framework that minimizes the burden of converting Firefox to securely and
efficiently use untrusted code. To enable this, RLBox employs static
information flow enforcement, and lightweight dynamic checks, expressed
directly in the C++ type system.
RLBox supports efficient sandboxing through either software-based-fault
isolation or multi-core process isolation. Performance overheads are modest and
transient, and have only minor impact on page latency. We demonstrate this by
sandboxing performance-sensitive image decoding libraries ( libjpeg and libpng
), video decoding libraries ( libtheora and libvpx ), the libvorbis audio
decoding library, and the zlib decompression library.
RLBox, using a WebAssembly sandbox, has been integrated into production
Firefox to sandbox the libGraphite font shaping library.
Overview — RLBox Sandboxing API documentation https://docs.rlbox.dev/
docs.rlbox.devOverview — RLBox Sandboxing API documentation
1554268 - (wasm-sandbox) [meta] Toolkit for sandboxing third-parties libraries in Firefox https://bugzilla.mozilla.org/show_bug.cgi?id=1554268
bugzilla.mozilla.org1554268 - (wasm-sandbox) [meta] Toolkit for sandboxing third-parties libraries in FirefoxNEW (nobody) in Core - General. Last updated 2020-03-04.
