The V8 Sandbox: From Compiler Correctness to Runtime Containment
summary
Shifts the security goal from compiler correctness to runtime containment and ships a lightweight, in-process sandbox in Chromium that confines all V8 objects to a 1 TB sandbox region so JIT bugs can only corrupt sandbox memory. Raw 64-bit pointers become 40-bit offsets plus a base register; out-of-sandbox references use indexed tables. Prototype hardware support works with Intel MPK and targets ARM PoE2. Bytecode verification and fuzzing are planned, the rollout starts in 2021–22 and already shows a modest drop in exploitable V8 bugs.
AI-written summary · about
chapters (10)
- 0:00V8 sandbox research intro
- 1:29JavaScript engine security hotspots
- 8:10Compiler risks in optimizations
- 16:37Reducing compiler bugs
- 29:06Correctness vs security with sandboxing
- 37:38V8 sandbox mechanics
- 46:09Future of sandboxing
- 50:26Current challenges
- 53:17Secure JS engines vision
- 53:59Q&A
related talks
49mChrome Browser Exploitation: from zero to heap sandbox escape
36mSandboxing Your Sandbox: Leveraging Hypervisors for WebAssembly Security
24mWebAssembly as an Intermediate Language for Provably-Safe Software Sandboxing
28mWhat's Happening in V8?
47mSecure Sandboxing in a Post-Spectre World
26mSyscall Me by Your Name: Sandboxing Wasm Programs
37mFinding Bugs in V8: A Formal Verification Approach
23mRuntime.JS: V8 JavaScript Kernel