Microsoft has introduced a new feature called "Windows Defender Application Guard"

The video from Microsoft explained that (WDAG) allows the user to isolate the code running within one page in what is called "Container" that is based on Hyper-V.

My question is, how is that different from normal sandboxing discussed in Wikipedia

JavaScript and the DOM provide the potential for malicious authors to deliver scripts to run on a client computer via the web. Browser authors contain this risk using two restrictions. First, scripts run in a sandbox in which they can only perform web-related actions, not general-purpose programming tasks like creating files.

Which supposed to also Isolate the code running in a page?

1 Answer 1


This type of scheme protects against other web-based threats besides JS sandboxing. JS sandboxing is mainly about securing the tab from other tabs, it's not so much about protecting the computer, even though that's a side-effect when done right.

If you look at actual breaches, it's been a long time since a browser sandbox issues hurt users. It's what happens outside of the JS sandbox that burns them: flash exploits, PDFs, word macros, jscript shell, etc. By tying all those browser "helpers" into a separate container instead of the full OS, the attack surface is minimized. Other browsers just try to make sure it never even gets to that point. Maybe MS is unsure about locking down IE/dredge, so they lock down the space around it as well. Probably can't hurt at any rate.

It's somewhat akin to booting off a DVD so that bad things from the net can't hose the hard-drive's OS.

  • There are still circumstances in which browser sandbox issues hurt users. For example there are some exploit chains that escalate themselves to kernelmode entirely within the tight sandbox, because a kernel exploit they use doesn't rely on win32k syscalls (for example).
    – forest
    Dec 16, 2017 at 2:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .