Firefox Fission: How Site Isolation Works and Why It Matters

Firefox's Fission project, also known as Site Isolation, revolutionized how the browser handles process separation. The update, now enabled by default, serves to improve security and performance. Before Fission, Firefox utilized a multi-process architecture called e10s, wherein the browser's user interface resided in one process, while web content ran in content processes. Multiple tabs could share these content processes.

Post-Fission, each site origin is assigned its distinct isolated process. For instance, mail.google.com and docs.google.com operate in separate processes, even though they share the same domain. Similarly, an iframe from evil.com embedded within trusted.com enjoys its own individual process. This level of isolation aims to enhance the browser's security posture.

The primary motivation behind Fission's inception was to counteract hardware vulnerabilities such as Spectre and Meltdown, which enable a process to illicitly access memory from other processes present on the same CPU core. Without site isolation, a malicious site nested within an iframe could potentially exploit these vulnerabilities to access cross-origin data, including authentication tokens, credentials, and user data.

However, with Fission, each origin is segregated into its unique process. This means that even if a site were to exploit Spectre, it would be confined to reading only its own process's memory, thereby preventing unauthorized access to cross-origin data.

From a user perspective, the primary consequence of Fission is an increase in memory usage. Since each isolated site necessitates its own process, coupled with additional memory for process overhead, Firefox's overall memory consumption has risen following the implementation of Fission. Firefox attempts to mitigate this tradeoff by limiting the number of concurrent processes via the 'dom.ipc.processCount' setting.

The default value is automatically adjusted based on the available RAM. This adjustment ensures that performance degradation is generally neutral to positive, as sites are no longer interfering with each other's processes. Additionally, a crash in a content process, which could have previously affected multiple tabs, now only impacts the specific site's tabs, thanks to the enhanced crash isolation feature.

To verify Fission's status, one can navigate to about:support, where a status of '1/1 (Enabled by Fission)' should be displayed. Alternatively, the about:config page allows one to check the 'fission.autostart' preference, which should be set to true. Extensions also benefit from Fission, as they now operate within their own processes, ensuring isolation from web content.

This isolation is crucial, as some extension APIs that previously relied on shared memory behavior have required updates to maintain compatibility with Fission.

Fission also complements Firefox's Total Cookie Protection (TCP) feature, which further fortifies data layer isolation. TCP ensures that each top-level site possesses its distinct cookie jar, thereby preventing trackers from accessing cookies set by other sites. Together, Fission and TCP collectively mitigate cross-site tracking and data leakage.

While Fission significantly bolsters the browser's security profile, similar to Chrome's site isolation, it does introduce a tangible memory tradeoff. However, on modern hardware, this impact tends to be manageable and typically goes unnoticed by most users, who can enjoy enhanced security without any additional effort.