1

A user may have multiple addons installed on a browser. But typically, the browser is running in userspace with an unprivileged uid. I was wondering how modern browsers can, in such a setting, provide an infrastructure so that different addons are properly isolated.

Informally speaking, isolation means one addon cannot read another addon's data, nor interfere with another addon's execution.

What kind of technology is being used here? Browser addons are typically implemented in JavaScript. Is the isolation provided by the JavaScript engine or at a different layer? What kind of support does the browser need from the underlying operating system and hardware?

1

Addons perform actions through a specific API provided by the browser. They do not run on their own as separate processes completely independent of the browser itself. It is entirely up to the browser to limit the API so a given addon or extension can only access features that it has permission to access and so that it can only access filesystem data that is intended for it. The browser itself does not actually need any specific hardware support (such as virtual memory management), since the addon is not executing arbitrary code directly on the processor.

The specific API depends on the browser. The Mozilla Firefox WebExtension API is different from the Google Chrome API. Any code running as an addon must use this API to request to access resources it does not own. For example accessing a file on the filesystem requires the script to request a service from the browser. It is up to the browser to refuse that service (whether because the browser itself cannot access the resource, or because the addon itself does not have sufficient permissions), or to grant it. The addon is powerless to contest this decision.

  • I'd think it's actually worse if addons run in the same process as the browser since the process isolation provided by the OS doesn't work. Typically addons are written in JavaScript. If addons are running in the same process, then there should be something happening in the JavaScript engine, but I don't have a very concrete image about that. – Cyker Aug 18 '18 at 1:59
  • @Cyker They're not necessarily run in the same process, but they don't spawn their own process that is completely independent of the browser. Generally a browser will create a new process or thread for addons, but the addon is still running under the extension API. As for using JavaScript, remember that, despite being Turing-complete, it still can't perform certain tasks like accessing arbitrary files on the filesystem, spawning arbitrary processes, or executing arbitrary files. – forest Aug 18 '18 at 2:00
  • @Cyker Process isolation alone typical provides few if any security guarantees. – curiousguy Aug 18 '18 at 3:14
  • @curiousguy At least one process cannot access another one's memory space without explicit consent? – Cyker Aug 18 '18 at 3:24
  • @Cyker While that is true, many operating systems have syscalls that permit this. For example process_vm_writev() on Linux. I believe Windows has an equivalent syscall. It's possible to disable this, but it is enabled by default. – forest Aug 18 '18 at 3:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.