July 22, 2026

Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine

Topic

JavaScript Engine sandboxing

Problem: JavaScript Engine is not safe

Critical Memory safety vulnerablilities

Causes

1. Java script Engine & its’inputs are complex -> large attack window.
2. Memory safety bugs are in runtime-generated code -> dynamic & realtime ex) JavaScript JIT produce code without bound check

Solution

Then let’s sandbox the JS engine

Prior works

1. Academic work / don’t support full browser(NaCIJIT, RockJIT, NoJITsu): Don’t handle the complexity of integration with JS engines in production browsers.
2. Industry work / frequently bypassed
   • Partially sandbox JS engine (Ubercage): positive assumption for safety -> Larger attack window.
   • Partial mitigation (JITCage) : selectively apply some SFI techniques -> protections are bypassable

Goal

Fully sandbox JS engine in the site’s process with Software-based Fault Isolation

• So even engine is broken, it doesn’t harm rest of other parts.
• Restrict memory space for JS engine -> space isolation

Challenge & Solution

1. How to seperate JS engine from FireFox?

There is a common pattern in control flow & data sharing -> develop tools to handle (implementation)

2. How to ensure correct workflow /while memory isolation for JS engine?

• seperate when the workflow touch sandbox area/ not sandbox area -> implement the detour function so that smoothly handle those 2 state for each use case.
• for secure disaggregation: sanitize any data received by Firefox that comes from JS engine -> DOM pointer table to store DOM pointer state.

3. How to keep overhead low /while sandboxing entire JS engine

Develop good SFI toolchain: MH-LFI

• how works?: rewrite assembly files to insert SFI-style guard checks into binaries.
• fastest x86-64 SFI toolchain to date
• efficient support for large sandboxes

4. How to keep engineering cost low /while sandboxing entire JS engine?

• Have a good API
• Use optimization technique

Thoughts & Questions

1. Isn’t it just a trade off between security <-> overhead? @

Isn’t the reason why prior work with partial security tools for ensure lower overhead?

2. How does isolate memory for JS engine? static? or dynamic?

if static then -> what if there is dynamic requirement fluctuation the memory is needed by JS engine? if allocate conservatively, it would be waste. if dynamic then -> Does memory space isolation would work well, even when memory isolation size should be changed dynamically?

Input

• Browsers have historically resorted to process-based isolation to address security concerns.
• Software Fault Isolation: by crеating isolatеd compartmеnts, or sandboxеs, within a softwarе systеm.
• Isolation Techniques
  1. SFI
  2. HW-based
  3. Safe language
  4. Validation-based: ex. eBPF