Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Site Isolation is Coming to Firefox

Mozilla is getting ready to boost the security of Firefox users with the addition of Site Isolation in the not too distant future. 

Mozilla is getting ready to boost the security of Firefox users with the addition of Site Isolation in the not too distant future. 

Dubbed Project Fission, the initiative aims to split cross-site iframes into different processes than their parent frame, marking a major step in the evolution of Firefox’s process model. 

The goal, Mozilla developer Nika Layzell says, is to protect not only against known vulnerabilities, but also against potential future vulnerabilities. 

The initiative is a reaction to Spectre and Meltdown, major CPU security vulnerabilities revealed last year and found to impact almost all modern processors. The bugs could lead to exfiltration of secrets stored in memory of other running programs via side channels, including cryptographic keys and passwords.  

The timing attack posed a serious threat to browsers, mainly due to the fact that webpages often serve JavaScript from multiple domains that run in the same process.

“We were able to mitigate these vulnerabilities right away. However, these mitigations may not save us in the future if another security vulnerability is released exploiting the same underlying problem of sharing processes (and hence, memory) between different domains, some of which may be malicious,” Layzell notes. 

Google has already addressed such concerns with the introduction of Site Isolation in Chrome at the end of 2017, and Mozilla is currently working on making a similar move with Project Fission, which has been under development for the past year. 

“In the coming weeks and months, we’ll need help from all Firefox teams to adapt our code to a post-Fission browser architecture. Fission is a massive project, spanning across many different teams, so keeping track of what everyone is doing is a pretty big task,” Layzell says. 

With much of the initial infrastructure ground work already done, Mozilla is moving to keeping track of Project Fission’s evolution in milestones (collections of new features and improved functionality), with Milestone 1 currently targeted for the end of February. 

However, Layzell hasn’t yet provided an estimated availability date for Site Isolation in Firefox. 

Related: Researchers Disclose 7 New Meltdown, Spectre Attacks

Related: Chrome Improves Security for Enterprise Use

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.