Mozilla is introducing a new security feature that it claims will make Firefox the most secure browser available to consumers. The new sandbox tool, called RLBox, is available with today's Firefox 95 update and was developed in collaboration with the University of California, San Diego and the University of Texas.
See also: Mozilla ends support for Firefox Lockwise app
All modern browsers use sandboxing to protect users from malicious code. The problem is that many of the more advanced exploits combine two vulnerabilities to bypass these protections. With RLBox, Firefox will compile a process into WebAssembly and then convert it to native code. According to Mozilla, this approach has two major advantages. It prevents code from jumping between different parts of a program and restricts access to specific areas of system .
See also: Firefox Relay offers unlimited email aliases (premium version)
With today's release, Mozilla will use RLBox to isolate five Firefox components, including the browser's Graphite font rendering engine and the Ogg media engine. If the system works as expected, the company says that "even a zero-day vulnerability in any of the five components [should not pose a threat to Firefox.".
See also: Mozilla Firefox: The first Chromium alternative in the Windows Store
Mozilla it won't be able to use RLBox to protect every component of Firefox. For example, it's not suitable for modules that rely on sharing memory with the rest of the program. However, the company hopes that other developers will use the technology to make their software more secure. In the meantime, RLBox is now available in all versions of Firefox for desktop and mobile.
Information source: engadget.com
