Mozilla is getting ready to boost the security of Firefox users with the addition of Site Isolation in the not too distant future.
Dubbed Project Fission, the initiative aims to split cross-site iframes into different processes than their parent frame, marking a major step in the evolution of Firefox’s process model.
The goal, Mozilla developer Nika Layzell says, is to protect not only against known vulnerabilities, but also against potential future vulnerabilities.
The initiative is a reaction to Spectre and Meltdown, major CPU security vulnerabilities revealed last year and found to impact almost all modern processors. The bugs could lead to exfiltration of secrets stored in memory of other running programs via side channels, including cryptographic keys and passwords.
The timing attack posed a serious threat to browsers, mainly due to the fact that webpages often serve JavaScript from multiple domains that run in the same process.
“We were able to mitigate these vulnerabilities right away. However, these mitigations may not save us in the future if another security vulnerability is released exploiting the same underlying problem of sharing processes (and hence, memory) between different domains, some of which may be malicious,” Layzell notes.
Google has already addressed such concerns with the introduction of Site Isolation in Chrome at the end of 2017, and Mozilla is currently working on making a similar move with Project Fission, which has been under development for the past year.
“In the coming weeks and months, we’ll need help from all Firefox teams to adapt our code to a post-Fission browser architecture. Fission is a massive project, spanning across many different teams, so keeping track of what everyone is doing is a pretty big task,” Layzell says.
With much of the initial infrastructure ground work already done, Mozilla is moving to keeping track of Project Fission’s evolution in milestones (collections of new features and improved functionality), with Milestone 1 currently targeted for the end of February.
However, Layzell hasn’t yet provided an estimated availability date for Site Isolation in Firefox.
Related: Researchers Disclose 7 New Meltdown, Spectre Attacks
More from Ionut Arghire
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- Latitude Financial Services Data Breach Impacts 300,000 Customers
- US Government Warns Organizations of LockBit 3.0 Ransomware Attacks
- New ‘Trigona’ Ransomware Targets US, Europe, Australia
- New Espionage Group ‘YoroTrooper’ Targeting Entities in European, CIS Countries
- CISA Seeks Public Opinion on Cloud Application Security Guidance
- Data Breach at Independent Living Systems Impacts 4 Million Individuals
Latest News
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- NBA Notifying Individuals of Data Breach at Mailing Services Provider
- Adobe Acrobat Sign Abused to Distribute Malware
- New York Man Arrested for Running BreachForums Cybercrime Website
- Huawei Has Replaced Thousands of US-Banned Parts With Chinese Versions: Founder
- Latitude Financial Services Data Breach Impacts 300,000 Customers
- US Government Warns Organizations of LockBit 3.0 Ransomware Attacks
- New ‘Trigona’ Ransomware Targets US, Europe, Australia
