In the newest version of Firefox, released Tuesday, Mozilla has introduced site isolation, a new feature that separates the contents of sites from each other as a method to defend against side-channel attacks such as Spectre and Meltdown.
Site isolation is a simple idea meant to address complex attacks that take advantage of the way that modern processors handle execution to allow malicious code to read memory in various locations. With site isolation enabled, Firefox loads each site in its own separate process, preventing content from a benign site from being loaded with a potentially malicious site. The feature arrives in Firefox 94 for desktop, which Mozilla released today.
“Without Site Isolation, Firefox might load a malicious site in the same process as a site that is handling sensitive information. In the worst case scenario, a malicious site might execute a Spectre-like attack to gain access to memory of the other site,” Anny Gakhokidze of Mozilla said in a post explaining the feature.
“Suppose you have two websites open – www.my-bank.com and www.attacker.com. As illustrated in the diagram above, with current web browser architecture it’s possible that web content from both sites ends up being loaded into the same operating system process. To make things worse, using a Spectre-like attack would allow attacker.com to query and access data from the my-bank.com website.”
Since the disclosure of Spectre and Meltdown in 2018, a number of other variants or similar techniques have been discovered, as well, and though executing those types of attacks is not simple, the threat from them is significant. Chip manufacturers have added hardware-level mitigations for many of these attacks, browser makers have had to make changes, too. Google added site isolation in Chrome 67 for Windows, Mac, Chrome OS and Linux in 2018.
Firefox 94 also includes fixes for a number of high-severity vulnerabilities, including a group of bugs that may result in remote code execution.
“Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code,” Mozilla said in its advisory.