IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Firefox 95 boosts protection against zero-day attacks

Mozilla's browser now takes a more granular approach to walling off code

Mozilla is shipping a security technology with Firefox 95 that it hopes will stop zero-day attacks targeting users of the browser. 

Called RLBox, the new feature will take a more granular approach to sandboxing, a security approach that runs website code in its own walled-off section of memory to avoid malicious components affecting the rest of the system.

In a blog post announcing the feature, Mozilla distinguished engineer Bobby Holley highlighted a problem with existing browser sandboxing technology, which isolates web site processes in individual sandboxes, and is vulnerable to chained attacks.

Malware developers can compromise the process first, and then escape the sandbox, it warns. It also limits the extent to which code can be separated into different sandboxed processes because of the memory overhead involved.

Developed in conjunction with the University of California San Diego and the University of Texas, RLBox complements process-based isolation with a new approach. It compiles code as native code via WebAssembly, which is a portable compilation format.

This makes each separately compiled piece of native code safer, because it can't access memory outside of a specified region and can't make any unexpected jumps. The new approach makes it possible to run different pieces of trusted and untrusted code in the same process without them affecting each other.

Related Resource

How to manage AI risk

Recommendations from the Cyber Resilience Think Tank

Two red robots fly on a yellow backgroundFree download

"RLBox is a big win for us on several fronts: it protects our users from accidental defects as well as supply-chain attacks, and it reduces the need for us to scramble when such issues are disclosed upstream," said Holley.

RLBox is a stand-alone project that Mozilla first trialed on macOS and Linux users last year. It is now deploying it across all Firefox platforms, including mobile systems.

Mozilla will begin with RLBox support for the Graphite font rendering system, the Hunspell spell checker, and the Ogg multimedia container format in Firefox 95. It will follow this up in Firefox 96 with support for the Expat XML parser and Woff2, the font compression technology used in the browser.

"Going forward, we can treat these modules as untrusted code, and — assuming we did it right — even a zero-day vulnerability in any of them should pose no threat to Firefox," Holley said. He also hoped that other browsers would adopt the open-source technology.

Mozilla has updated its bug bounty program to reward researchers for escaping the sandbox technology without exploiting vulnerabilities in an isolated component.

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Chrome vs Firefox vs Microsoft Edge
web browser

Chrome vs Firefox vs Microsoft Edge

8 Dec 2021
Mozilla to end support for Firefox Lockwise password manager
web browser

Mozilla to end support for Firefox Lockwise password manager

24 Nov 2021
Firefox available on Microsoft Store for first time
web browser

Firefox available on Microsoft Store for first time

9 Nov 2021
Kaspersky exposes MysterySnail zero-day exploit in Windows
zero-day exploit

Kaspersky exposes MysterySnail zero-day exploit in Windows

13 Oct 2021

Most Popular

Europe's first autonomous petrol station opens in Lisbon
automation

Europe's first autonomous petrol station opens in Lisbon

23 May 2022
Nvidia pauses hiring to help cope with inflation
Careers & training

Nvidia pauses hiring to help cope with inflation

23 May 2022
Open source packages with millions of installs hacked to harvest AWS credentials
hacking

Open source packages with millions of installs hacked to harvest AWS credentials

24 May 2022