En general, websites cannot access data from other sites web in the browser through the same origin policy.
However, malicious sites may try to circumvent this policy to attack other websites. and occasionally, security bugs are found in browser code that applies the same origin policy.
The Chrome team aims to fix these errors as quickly as possible.
How Site isolation works
It must be remembered that Chrome has always had a multi-process architecture where different tabs could use different rendering processes.
A certain tab can even change the processes when you navigate to a new site in some cases. However, it was still possible for an attacker's page to share a process with a victim's page.
For example, cross-site iframes and site pop-ups often remain in the same process as the page that created them.
This would allow a successful Spectrum attack to read data (eg cookies, passwords, etc.) that belong to other frames or pop-ups in your process.
Site isolation(site isolation) is a Chrome security feature It provides an additional line of defense so that these attacks are less likely to be successful.
It ensures that the pages of the different websites are always placed in different processes, each of which runs in a sandbox that limits what the process can do.
It also prevents the process from receiving certain types of sensitive data from other sites.
Therefore, with site isolation, it is much more difficult for a malicious website to use speculative side-channel attacks like Specter to steal data from other sites.
When site isolation is enabled, Each rendering process contains documents from no more than one site.
This means that all document navigations between sites cause a tab change in the processes. It also means that all cross-site iframes are placed in a different process than their main frame, using out-of-process iframes.
Firefox will officially go into isolation in turn.
After a year of secret preparations, Mozilla has announced its intention to implement a site isolation feature.
Chrome's site isolation feature was designed as a security mechanism for the Chrome browser years before its release, but its implementation coincided with the public disclosure of the Meltdown and Specter processor failures, which site isolation mitigated by full.
Mozilla, which also provided the Meltdown and Specter patches to reduce the precision of various JavaScript functions in Firefox, found Google's approach to processor flaws to be superior because it also allowed avoids future similar exploits and many other security problems.
Nika Layzell, a developer at Mozilla, said the foundation had started work on a similar site isolation mechanism. last year as part of a project under the internal codename Project Fission.
For the past year, we have been working to develop the Fission base by designing new infrastructure. In the coming weeks and months, we will need the help of all Firefox teams to adapt our code to a post-Fission browser architecture.
The post-Fission browser architecture that Layzell refers to is similar to Chrome's current operation. The Mozilla developers also plan to isolate each website that the user accesses in a separate process.
Currently, Firefox comes with a process for the browser user interface and some processes (two to ten) for the Firefox code for rendering websites.
With Project Fission, these latter processes will be modified and a separate process will be created for each website accessed by the user.
The wording is weird