V8 incorporates new sandbox [LWN.net]

V8, the JavaScript engine used in Chrome, announced that its memory sandbox is no longer experimental.

Chrome 123 could therefore be considered to be a sort of "beta" release for the sandbox. This blog post uses this opportunity to discuss the motivation behind the sandbox, show how it prevents memory corruption in V8 from spreading within the host process, and ultimately explain why it is a necessary step towards memory safety.

to post comments

V8 incorporates new sandbox

Posted Apr 4, 2024 18:14 UTC (Thu) by khim (subscriber, #9252) [Link] (3 responses)

And another attempt to use compiler to enforce security boundary have bitten the dust.

It was so predictable… but better later than never, I guess.

V8 incorporates new sandbox

Posted Apr 4, 2024 18:56 UTC (Thu) by atnot (guest, #124910) [Link] (2 responses)

Have you read the article? This is still using the compiler as a security boundary, it's just making it harder to turn JS heap writes into arbitrary memory writes by banishing pointers from the JS heap.

V8 incorporates new sandbox

Posted Apr 4, 2024 20:03 UTC (Thu) by khim (subscriber, #9252) [Link] (1 responses)

Have you read the article?

Sure

This is still using the compiler as a security boundary, it's just making it harder to turn JS heap writes into arbitrary memory writes by banishing pointers from the JS heap.

That's close to what BPF does: they make compiler generate provably-safe code by disallowing certain patterns. The only thing missing is verifier, but I suspect it's only temporary, they would need to add it later, when their memory sandbox would start becoming more and more complex.

V8 incorporates new sandbox

Posted Apr 4, 2024 20:21 UTC (Thu) by atnot (guest, #124910) [Link]

Glad you've read it now. Fwiw, I personally don't inherently see how there would be a meaningful difference security wise between taking in an IR and then interpreting and jitting that to native code, vs taking in text, parsing it into an IR and then doing the same thing. Aside from the extra attack surface of the parser, but that doesn't seem to be a huge issue these days. The BPF or WASM runtimes are really just as much of a compiler as V8 is and mostly vulnerable to the same kinds of issues.

V8 incorporates new sandbox

Posted Apr 8, 2024 20:46 UTC (Mon) by riking (subscriber, #95706) [Link]

The primary impact of removing the "experimental" tag is that Chrome is now willing to pay you for finding a hole.