Mozilla has announced that it is working on a new security-related project for Firefox called “Project Fission.” It should be noted that this is not to be confused with “Project Fusion,” which protects users against existing and future Spectre attacks, as well as potential vulnerabilities.
Mozilla has given it the codename Project Fission because it wants to emphasize isolation. The non-profit project aims to isolate not only the UI and content of a web page, but also other domains that connect to it. This would ensure that a website's data would be easily accessible to attackers to exploit other attacks, such as Spectre and Meltdown. It should be noted that Spectre-class attacks allow an attacker to extract data stored in memory from other applications or web pages. The damage caused by malicious Javascript code injected into sites from other domains should have been limited since Project Fission was activated.
Like Mozilla, Google Chrome has been enabling a similar protection called Site Isolationsince last year. According to Mozilla's announcements, the project will be enhancing the first Project Mission by the end of this month, and that will include support for out-of-process iframes, which means they will be done inside a different process.
What does Mozilla 's " Project Fission " include ?
Project Fission is a revamped version of the “Electrolysis” architecture that Firefox had adopted back in 2016. Initially, the “Electrolysis” architecture would isolate only the browser’s UI from all web content. Later, Mozilla enabled the addition of three sandboxes/processes, for a total of five by default: one for the UI and four for web content. Users were free to modify as many content sandboxes as they wanted for the Firefox browser. Mozilla said that even though this architecture is not as strict as Chrome’s, it was an advantage due to its low memory requirements. After all, Chrome has been criticized for using a lot of memory. However, both Mozilla and Google realized that such architectures are not secure, and in a world where CPUs do not come with hardware mitigations against speculative attacks, these projects require the protection of users.
