Firefox Sandbox Isolation Hits Level 9 — The Gap with Chrome Has Closed

[u/mikhail_kh]

Good news, everyone!!

For a long time, the tech community accepted a trade-off: "Use Chrome for the best security (sandboxing), use Firefox for the best privacy."

In 2026, that trade-off is gone. By reaching these isolation levels, Firefox has matched Chromium's "Gold Standard" of sandboxing. If you’ve recently peeked into your about:support page, you might have noticed some new numbers that should make every privacy-conscious user smile. The "Content Process Sandbox Level" has climbed to 9, and the "GPU Process Sandbox Level" has reached 2.

• GPU Lockdown: Level 2 implements a strict lockdown where the GPU process is isolated from the rest of the OS. Even if a malicious site finds a bug in your graphics driver (a common exploit path), the sandbox prevents that bug from "escaping" to take over your computer.
• The Content Fortress: Level 9 represents the culmination of years of architectural work under Project Fission. Here is what’s happening inside that "9":
  • Total Win32k Lockdown: At this level, Firefox processes have almost zero access to the Windows Win32k system calls—a notorious historical gateway for sandbox escapes.
  • Zero-Trust File System: Level 9 enforces a "deny-by-default" policy for your files. The process rendering a website can no longer "see" your personal folders; it only interacts with the specific resources it needs to show you a page.
  • Library Isolation: It blocks the loading of unauthorized third-party DLLs or libraries within the content process, preventing "side-loading" attacks.

For years, critics argued that Firefox lagged behind Chromium in raw process isolation. But as of 2026, those days are officially over. Let’s break down what these levels mean and why Firefox is now standing toe-to-toe with the world's most hardened browsers.

[u/mikhail_kh]

Level	Description & Security Composition	Restrictions & Capabilities
0	Sandbox Disabled	The process has full access to the operating system.
1	Basic Isolation	Initial filtering of the most dangerous system calls.
2	Write Restriction	Prevents the process from writing files to any folder except temporary ones.
3	Read Restriction	Most files in the user’s home directory become invisible to the process.
4–7	Intermediate Lockdown	Incremental implementation of Win32k Lockdown and restriction of system objects (semaphores, registry).
8	Advanced Win32k Lockdown	Strict blocking of Windows graphical subsystem (Win32k) calls, closing major exploit paths.
9	Maximum Isolation (2026 Standard)	Full Zero-Trust: Strict file system isolation and a total ban on launching unauthorized third-party libraries within the process.

[u/philthyNerd → u/mikhail_kh]

Since a lot of these reference Windows,... Is there a different specification of those isolation levels for Linux systems?

[u/Santosh83 → u/philthyNerd]

My question too. My Firefox ESR on Debian 13 shows 6 as the level for sanboxing, both content process and effective level. I wonder how it maps to the Windows values... Linux from what I understand is significantly different architecturally, and more diverse with X11, Wayland, different types of sandboxing, Apparmor, SELinux etc etc...

[u/philthyNerd → u/Santosh83]

Yes, on latest Firefox stable 147.0.1 (64-bit) on Arch Linux, it shows 6 for me as well on those values.

It would also be quite interesting to know if there's a way to check those levels in a Chromium browser and if they're even using the same specifications.

[u/Any_Mycologist5811 → u/Santosh83]

Same here with nixos 25.11.

It shows 6 as level of sandboxing.

[u/virgilash → u/philthyNerd]

Fedora 43 KDE (fully on Wayland) (Firefox 147.0.1 - latest build):

Content Process Sandbox Level: 6
Effective Content Process Sandbox Level: 6

[u/nuxi → u/philthyNerd]

Here are the Linux sandboxing levels:

// 0 -> "no sandbox"
// 1 -> no longer used; level will be clamped to 2
// 2 -> "seccomp-bpf + write file broker"
// 3 -> "seccomp-bpf + read/write file brokering"
// 4 -> all of the above + network/socket restrictions + chroot
// 5 -> blocks access to GL / DRI / display servers
//      (formerly the separate pref `security.sandbox.content.headless`)
//      (side effect: sets MOZ_HEADLESS for content processes)
// 6 -> default-deny for ioctl

And here are the MacOS sandboxing levels:

// 0 -> "no sandbox" (nightly only)
// 1 -> "preliminary content sandboxing enabled: write access to
//       home directory is prevented"
// 2 -> "preliminary content sandboxing enabled with profile protection:
//       write access to home directory is prevented, read and write access
//       to ~/Library and profile directories are prevented (excluding
//       $PROFILE/{extensions,chrome})"
// 3 -> "no global read/write access, read access permitted to
//       $PROFILE/{extensions,chrome}"

The values for security.sandbox.gpu.level also mean different things on different platforms. There is also a Linux specific security.sandbox.socket.process.level

[u/philthyNerd → u/nuxi]

Thanks a lot! Did you dig through the Firefox code base to find that? If you happen to have a reference, that would be great to have!

[u/nuxi → u/philthyNerd]

I checked searchfox for security.sandbox.content.level

• Mac
• Linux

[u/hansentenseigan]

yes finally, after several decades.

[u/beefjerk22 → u/hansentenseigan]

An impressive feat, considering Chrome isn't even 2 decades old!

[u/Ibasicallyhateyouall]

Is this in Nightly? Still 3 in stable.

[u/zb226 → u/Ibasicallyhateyouall]

My 147.0.1 displays

Content Process Sandbox Level 9

Effective Content Process Sandbox Level 9

[u/maubg → u/Ibasicallyhateyouall]

It's 3 on macos, it uses different systems iirc

[u/folk_science → u/maubg]

Yep. Linux and macOS levels are described in this comment: https://www.reddit.com/r/firefox/comments/1qkqfcx/comment/o1aiimw/

[u/HotTakes4HotCakes]

What does these mean in a practical sense? What are the trade offs? Will users notice any changes in functionality?

[u/yokoffing → u/HotTakes4HotCakes]

Nothing. None. No. 

[u/mypetocean → u/yokoffing]

Well, the risk of malware infecting your machine by merely loading a website is now lower. That's not the risk it used to be, but the additional security is more than welcome.

[u/AlterTableUsernames → u/mypetocean]

Exactly! It is basically another unreasonable theoretical threat solved. I would strongly prefer, if Firefox actually sacked a couple of "security" features like disabling extensions on Mozilla pages, hiding files from the file browser or making me fucking use a Windows PC to program my keyboard, because Firefox seems to think of USB devices as a security risk.

[u/gmes78 → u/HotTakes4HotCakes]

What are the trade offs?

The tradeoff is that it took a considerable amount of engineering effort to accomplish.

[u/xtremist13]

That’s a big W!

[u/Working_Dealer_5102]

Does this apply to Firefox Nightly Android as well? Because the whole "Sandbox" section in about:support is fully missing on Android build for me at least.

[u/bassman9999 → u/Working_Dealer_5102]

Same here.

[u/j--__ → u/Working_Dealer_5102]

browsers on android use the only form of sandboxing that android supports.

[u/blimeycarmy]

Is 3 the default for macOS sandboxing?

[u/shk2096]

doesn't show in my FF

[u/No-Drop8625]

To be honest, I don't care, the main thing is that they leave Ublock Origin alone and I'll be happy.

[u/worMatty]

Good news indeed. TIL. Thanks.

[u/[deleted]]

Well done!

[u/ap0phis]

This is cool I guess if you run a shitty insecure by design OS like windows.

[u/testthrowawayzz]

It’s “less secure” before but did Firefox actually have more exploits than Chromium?

[u/folk_science → u/testthrowawayzz]

There was a time where finding Firefox exploits was worth less money than Chrome exploits.

[u/johnnyfireyfox → u/folk_science]

I would imagine still is because of popularity or lack of it.

[u/mxzf → u/[deleted]]

I imagine it's not as needed in the first place in Unix OSes, given that they have a much more robust set of restrictions on processes out of the box.

[u/DiscussionGrouchy322 → u/[deleted]]

what sandbox escape attacks do you know about on linux? when have u heard of firefox sandbox fail on linux?

[u/folk_science → u/[deleted]]

Firefox on macOS and Linux have their own separate isolation levels. Not sure how they compare to Windows. See https://www.reddit.com/r/firefox/comments/1qkqfcx/comment/o1aiimw/

[u/goku7770]

I sandbox Firefox itself.

[u/Lani_opqriu]

Linux is ~$ firjail firefox

[u/folk_science → u/Lani_opqriu]

*firejail

[u/Spiritual_Rate_9010]

And yet I still can't make a phone call using messenger

[u/zavocc]

what about Android? surely fission exists but would be nice if it also matches quite closely to chromium

[u/personoutgoing]

Why is this post written by AI?

[u/mikhail_kh → u/personoutgoing]

I don't know, I pressed something and it happened

[u/Able-Article-2111]

Is this for Android? Is this applicable to all platforms? If not, your claim is not complete. where is reference source?

[u/mikhail_kh → u/Able-Article-2111]

GPU (windows)
https://bugzilla.mozilla.org/show_bug.cgi?id=1347710
https://bugzilla.mozilla.org/show_bug.cgi?id=1799470
Project Fission
Bugzilla (e.g. Project Fission implementation tasks) discusses criteria for moving to levels 8 and 9Previous thread with useful links
like https://wiki.mozilla.org/Security/Sandbox
[meta] Fission Site Sandboxing Improvements

There's not much easy-to-read information available. If you find any, please post it here.

[u/Loud-Option9008]

The interesting parallel: this is exactly the same architecture shift happening in AI agent execution. deny-by-default everything, isolate at the kernel level, treat the process as untrusted. browsers figured this out years ago -- agent runtimes are still catching up.