Mozilla taps WebAssembly for browser security

Mozilla is using WebAssembly-based memory sandboxing technology to improve security in the Firefox browser. Called RLBox, the technology allows Mozilla to quickly convert Firefox components to run inside a WebAssembly sandbox.

Developed by university researchers, RLBox is a toolkit for sandboxing third-party libraries. It combines a WebAssembly-based sandbox and an API to retrofit existing application code to interface with a sandboxed library. The isolation offered by RLBox is planned for inclusion in Firefox 74 on Linux and Firefox 75 on macOS, with Windows support to follow soon afterward. Firefox 74 and Firefox 75 are scheduled to arrive in March and April, respectively.

[ Also on InfoWorld: What is WebAssembly? The next-generation web platform explained ]

WebAssembly is a portable code format that has attracted attention as a way to provide near-native performance for web applications. WebAssembly (aka Wasm) serves as a compilation target for a number of languages including C/C++ and Rust, allowing those language to run in the browser.

The principle behind WebAssembly sandboxing is that C/C++ can be compiled into Wasm code, which then can be compiled into native code for the host machine. Firefox already has “core infrastructure” for Wasm sandboxing in place; Mozilla now plans to increase its impact across the Firefox codebase. Initial efforts are focused on sandboxing third-party libraries bundled with the browser. The technology will be applied to first-party code as well.

Wasm sandboxing will join other memory safety techniques used in the Firefox codebase: eliminating memory hazards, breaking code into multiple sandboxed processes with reduced privileges; and rewriting code in a safe language like Rust. Process-level sandboxing works well for large, pre-existing components, but it uses up substantial system resources so can only be used sparingly.