Mozilla has announced the start of mass testing in nightly builds and beta releases of Firefox's strict site isolation mode, developed under the Fission project. This mode expands the application of a multi-process architecture — instead of a fixed pool of processes, a separate process is created for each site. Management of the Fission mode activation is done through the variable "fission.autostart=true" in about:config or on the about:preferences#experimental page.
It should be noted that the multi-process model used in Firefox until now involved launching a pool of handler processes: by default, 8 main processes for content handling, 2 additional unprivileged processes for web content, and 4 auxiliary processes for add-ons, GPU interaction, networking operations, and multimedia data decoding. The distribution of tabs across processes was random; for example, a bank site and an untrustworthy dubious resource could end up being processed in the same process.
The new mode isolates the processing of each site into a separate process, not based on tabs, but on domains, which further isolates the content of external scripts and iframe blocks. For separate processing of subdomains of standard services associated with different sites, the segmentation is based not on formal but on actual (eTLD) domains. top-level domains, marked in the Public Suffix list (i.e., the sites "a.github.io" and "b.github.io" will be isolated into different processes).
The strict isolation mode helps protect against side-channel attacks, such as those related to Spectre class vulnerabilities, which can lead to the leakage of information within a single process. The leakage of confidential data processed in the same process is possible with the execution of untrustworthy external code in engines with JIT. virtual machinesIn the context of web browsers, malicious JavaScript code from one site can obtain information about passwords, access keys, and credit card numbers entered on another site processed in the same process. Initially, to protect against channel attacks, browser developers restricted timer accuracy and blocked access to the SharedArrayBuffer API, but these measures only complicated and slowed down the execution of the attack (for example, a method was recently proposed for extracting data from the CPU cache that works entirely without JavaScript).
Among the other benefits of the strict site isolation mode are reduced memory fragmentation, more efficient memory return to the operating system, minimized impact of garbage collection and intensive computations on pages in other processes, improved load distribution across different CPU cores, and enhanced stability (a crash of the process handling an iframe won’t affect the main site and other tabs).
Some known issues that arise when using Fission include a noticeable increase in memory consumption, X11 connections, and file descriptors when opening a large number of tabs; disruption of some extensions; loss of iframe content when printing and calling the screenshot function; decreased effectiveness of document caching with iframes; and loss of content in filled but unsent forms when restoring a session after a crash.
Source: opennet.ru
