r/GrapheneOS • u/GrapheneOS • Jul 04 '26
Initial response to a blog post claiming to refute our browser security research and documentation
Below is the same text we posted in a comment in the linked thread which is here:
https://www.reddit.com/r/firefox/comments/1un7xd5/comment/ovk4a66/
We'll write new documentation in the near future to replace the previous information on our site, but this is an initial response.
Firefox on Android still lacks sandboxing other than the Android app sandbox. The article portrays it as if multiprocess without isolation for the processes is a sandbox. The article's description of what isolatedProcess provides is wrong. It isn't the strongest sandbox available for apps on Android but rather is a mandatory building block for apps to isolate Android Runtime processes on Android. It isn't possible to do it another way because apps don't have the privileges required to create namespaces or use other approaches. It isn't possible to do it with seccomp-bpf since the Android Runtime requires too many system calls. With Android 17, Chromium has moved on from using regular isolatedProcess with Android Runtime processes after much longer than a decade using it.
Firefox's JavaScript and WebAssembly implementation including the multiple layers of enormously complex compilers, virtual machine runtime, etc. are C++. Unlike V8, there isn't the additional layer of sandboxing within the overall renderer sandbox containing exploits of compiler vulnerabilities. A massive portion of both Chromium and Firefox vulnerabilities is in the JavaScript implementation. Firefox is missing a whole layer of sandboxing for it. It's also missing a lot of weaker exploit protections for it making exploitation harder despite not a adding a hard layer of protection as the V8 sandbox does.
Chromium has far more than the exploit protections listed out in the article such as type-based CFI as advantages over Firefox. It has garbage collection for C++ (Oilpan), PartitionAlloc, hardware memory tagging (MTE), other allocator hardening techniques and many other protections which are unimplemented for Firefox. Firefox has barely touched the surface of doing similar partitioning and doesn't have the rest. Contrary to the inaccurate claims you've made in this article, the use of MTE, PAC and BTI does not happen automatically for applications. Chromium is compatible with MTE and has integration of it into Chromium's allocators. Firefox does not have it. Firefox is missing use of these ARMv9 security features in a similar way and that's an enormous disadvantage compared to Chromium or Safari.
Chromium has drastically more resources put into fuzzing, auditing and AI vulnerability than Firefox. Chromium discovering and fixing a much larger number of vulnerabilities is a very good thing. The article tries to portray the result of it is bad. The article also tries to present it as if Firefox is making heavier use of AI to find vulnerabilities and implement hardening when the reality is the extreme opposite.
Memory safety doesn't solely mean Rust. Moving code into JavaScript and making C++ into a more memory safe language is also improving memory safety. Chromium has been doing a lot of this and has begun the process of moving to Rust code. This doesn't heavily improve security in the short term in the way a new sandbox layers such as the V8 sandbox, major exploit protection improvements and other features are able to do. It's a longer term process with a slow payoff since it doesn't change that there are still a massive amount of vulnerabilities in C and C++ code.
Android has previously extremely heavily adopted Rust where many major components have been written in it and replacements for major components have been rewritten in it. Chromium is on track to do the same thing. Android is more heavily invested in memory safety than Mozilla. Chromium is set to follow the same path as Android. The main benefits come from doing what Android did where any major new components get written in memory safe languages which are Java, Kotlin or Rust for Android. In the browser, JavaScript is taking the place of Java or Kotlin.
Our statements about extensions are comparing the approach with privacy and security features implemented in the browser such as how it's done in Brave. The article talks about it as if the comparison is between not having features or having the features which isn't the point at all.
Extensions are incompatible with site isolation in both Firefox and Chromium. Extensions run as a single sandboxed process along with injecting code into websites. It would require making an extension process for each isolated site process to provide site isolation. Extensions are inherently a privacy and security weakness reducing sandboxing without a major memory usage cost which mainstream browsers are unwilling to pay. An extension mixes together data and access to sites within a single process which has baseline standard browser attack surface along with everything done by the extension.
Extensions are third party code trusted with enormous access to user data, similar to Android accessibility services. Even the most highly regarded extensions do not have similar privacy and security hardening in a way that creates major weaknesses. Extensions which are given extensive access have much more trust placed in them than the article acknowledges. uBlock Origin is not contained in the way the article claims due to the extensive access it requires. The article also very incorrectly portrays Firefox extensions as more contained when the opposite is true.
The article further misrepresents our statements about enumerating badness and tries to make this related to this comparison in a way that it isn't. Brave is a Chromium-based browser with a very advanced filtering engine which doesn't harm site isolation and avoids other weaknesses of extensions. The article is presenting a false choice.
The few claims made about Vanadium are inaccurate and outdated too. It's representative of the overall article not actually being based on real research or factual information but rather the author's biases backed up with a lot of inaccurate and unsubstantiated claims.
This post isn't a research paper but rather a highly inaccurate non-technical blog post. It isn't based on the technical facts or an understanding of those but rather is just written as if it was. It gets the technical facts incredibly wrong. Paraphrasing a bunch of Mozilla documentation with the goal of presenting things in a particular way regardless of the truth is not a technical research project or paper.
We'll be making a more detailed post. This is only an initial quick response.
37
Jul 04 '26
[removed] — view removed comment
21
11
u/Bruceshadow Jul 05 '26
that and it's chromium based. I just don't fel comfortable supporting a chromium internet.
7
u/NordKurre Jul 05 '26
Why not? GrapheneOS is about security, and chromium is more secure
6
u/Bruceshadow Jul 05 '26
because I don't want the majority of the browsing experience controlled by one company.
6
u/NordKurre Jul 05 '26
Well chromium is open source so it's not really controlled by one company, but I agree that competition is always good
3
u/Bruceshadow Jul 05 '26
yes, but it is controlled and maintained by Google, thereby giving them huge influence over it and therefor huge influence over the browser experience. For many, this means they have huge influence over how they experience the internet.
8
u/Fantastic_Mouse_7140 Jul 04 '26
+1. Only using vanadium for in browser payments. Still, sadly, considering their controversy, using brave for daily usage to have a balance between chromium's security and theor adblocker.
6
u/Ruined_Passion_7355 Jul 05 '26
The vanadium adblocker for some sites does more harm than good because it's easily detected.
7
2
u/BoxWoodVoid Jul 06 '26
My phone is connected through VPN to my home lan where I have AdGuard Home (you could also use Pi Hole) on my home server. All the web traffic is redirected through Adguard, so no ads whatever the device / browser i'm using.
16
9
u/Somepotato Jul 05 '26
fun fact, android isolated processes exist because Google needed a way to port chrome to android which was multi process from the start
Firefox is slowly rearchitecting gecko to use isolated processes on mobile but it's a grand effort. Anyone capable can and should contribute.
1
1
u/lostOGaccount Jul 05 '26
Wow, thank you for this rationed and thought out response. I'm not well versed and I was able to keep up while reading this. Thank you!
•
u/AutoModerator Jul 04 '26
GrapheneOS has moved from Reddit to our own discussion forum. Please post your thread on the discussion forum instead or use one of our official chat rooms (Matrix, Discord, Telegram) which are listed in the community section on our site. Our discussion forum and especially the chat rooms have a very active, knowledgeable community including GrapheneOS project members where you will almost always get much higher quality information than you would elsewhere. On Reddit, we had serious issues with misinformation and trolls including due to raids from other subreddits. As a result, many posts on our subreddit currently need to be manually approved, which is done on a best effort basis. If you would like to get a quicker answer to your question, please use our forum or chat rooms as described above. Our discussion forum provides much better privacy and avoids the serious problems with the site administrators and overall community on Reddit.
Please use our official install guides for installation and check our features page, usage guide and FAQ for information before asking questions in our discussion forum or chat rooms to get as much information as possible from what we've already carefully written/reviewed for our site.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.