[fbender]

> Annoyingly Firefox is lagging behind in that regard.

This has not been true since quite a while. Firefox has employed sandboxing even before the multi-process work (which culminated in the Quantum branches of Fx releases that added more and more sandboxing with each release). Before that, Moz went a different way than OS level sandboxing by principal containerization (I forgot the correct term, sorry), which worked in terms of separation of execution contexts (of Web JS and other parts like the styling system, plus the browser internals). Elements of that implementation have been removed by now (iirc) since the multi-process split required different communication paths anyway (which also enabled per-origin/-tab/-window OS-Level sandboxing), so that code was no longer needed.

[MaxBarraclough]

Thanks for the reply, you know much more about it than I do.

What could an attacker do if they were able to trick the JIT into emitting evil native code?

[fbender]

I would say there is no simple answer to your question. However, I am not able to give you an authoritative answer to your question anyway. If you are interested, you can start here[1] or try and ping the moz-security people

[1] https://wiki.mozilla.org/Security/Sandbox

[MaxBarraclough]

Thanks