1. Chrome’s overall architecture: security is “designed”

1️⃣ Why does Chrome need multiple processes?

In one sentence:

Put untrustworthy web pages into different cages

Early browsers (single process):

• JS / DOM / Network / UI together
• One vulnerability = entire browser crashes

The core idea of ​​Chrome:

Stability = Security

2️⃣ Chrome core process division (required test)

Browser Process（大脑）
 ├── Renderer Process（网页）
 ├── Network Process（网络）
 ├── GPU Process（图形）
 └── Utility Process（解码/存储）

Security responsibilities of each process

Process	Security Function
Browser	Permission arbitration, UI
Renderer	Untrusted JS
Network	Unified network strategy
GPU	Prevent graphics card attacks

2. Renderer process: the "prison" of the web page

Renderer is the most dangerous place

What's in Renderer?

• Blink（DOM / CSS）
• V8 (JS engine)
• JS Heap
• DOM Tree

1️⃣ Site Isolation (key security mechanism) ⭐⭐⭐⭐⭐

Different sites → different Renderer processes

Why?

Prevent:

• Laterally read data from other sites after XSS
• Specter cross-site side channel attack

example.com → Renderer A
bank.com     → Renderer B

iframe different origins:

• There will also be different processes

2️⃣ Even if XSS is successful, what can you get?

Ability	Is it possible
Current Site Cookies	✅
Other Site Cookies	❌
local files	❌
Operating System	❌

👉 Process isolation is the last line of defense

3. V8 Architecture: How the JS engine “protects itself”

1️⃣ V8 execution level

JS Source
  ↓
Parser
  ↓
Ignition（解释器）
  ↓
TurboFan（JIT 编译）

⚠️ Security issues mainly occur in:

• JIT optimization
• Memory management

2️⃣ V8 memory model (focus of attack)

Heap
 ├── New Space（短命对象）
 ├── Old Space
 ├── Code Space
 └── Large Object Space

JS cannot:

• random access to memory
• pointer arithmetic
• Read and write any address

👉 This is the first layer of V8 security

3️⃣ Why is JIT a “high-risk area”?

Because:

• Will make radical assumptions (type stability)
• Check will be skipped
• There is a bug = out of bounds read and write

Real vulnerability:

• type confusion
• out-of-bounds

4️⃣ How does V8 reduce JIT risks?

1️⃣ Multi-layer verification

• Ignition (slow but safe)
• TurboFan (fast but rewindable)

2️⃣ Deopt

假设失效 → 回退解释执行

3️⃣ Pointer Compression

• Compresses heap pointers to save memory; it is not an independent security boundary

4. V8 + Chrome: dual sandbox

1️⃣ Renderer process sandbox

• OS level sandbox
• Restricts system calls and resource access through OS-specific mechanisms
• file system isolation

2️⃣ V8’s own sandboxing (Sandboxing)

The V8 heap sandbox aims to prevent corruption of V8 heap memory from spreading to other parts of the hosting process; it does not guarantee that native code execution, once obtained, stays inside V8. V8 explanation.

• Constrains accesses to V8 heap memory
• Uses mechanisms such as protected pointer tables to access objects outside the sandbox
• Host code and stacks are outside the heap sandbox; the renderer OS sandbox provides a separate layer of isolation

5. Specter: Why does it change everything?

Nature of the problem

• CPU out-of-order execution
• Can leak data across processes

Chrome responds

Means	Function
Site Isolation	The most critical
Disable high-precision timer	Anti-side channel
ArrayBuffer isolation	Anti-memory detection

6. A real attack path (you should know)

XSS
 ↓
利用 JIT bug
 ↓
逃逸 V8 沙箱
 ↓
突破 Renderer 沙箱
 ↓
攻击操作系统

👉 Chrome Goals:

Make every step extremely difficult

7. Why do front-end engineers need to understand this?

Because you do it every day:

• eval
• dynamic script
• Third-party SDK
• iframe
• WebAssembly

👉 Everyone is touching the safety boundary

8. Interview "Chrome/V8 Security" standard answer template

• Chrome uses multi-process architecture and Site Isolation to isolate different sites into different Renderer processes; the Renderer process runs in the operating system sandbox, restricting access to system resources; the V8 engine prevents JS from executing out of bounds through memory isolation, boundary checking, and JIT rollback mechanisms, thus forming a multi-layered defense system.