I am now using Firefox instead of Google Chrome for daily use, however I read in some sites that Firefox lacks in security while being better at privacy and Chrome the other way around. Is Firefox really less secure for not having a sandbox for general use? I know it uses a sandbox for Flash, DRM, etc. Am I wrong and that is the same case in Chrome or not, because I could not find that much information about it. I am already using uBlock Origin. Will "firejail" be a good sandbox for firefox for daily use?

  • 3
    Except Firefox 56+ actually does have a sandbox? – Ramhound Mar 30 '18 at 2:19
  • 3
    not to mention firefox with noscripts and a savvy user is safer than chrome will ever be. – Frank Thomas Mar 30 '18 at 2:21

Mozilla's Electrolysis project has allowed its browser to leverage the same sandboxing technologies Chrome does due to the implementation of a multiprocess architecture which uses a privileged process for managing the browser chrome and unprivileged content (child) processes for handling untrusted (web) content. The multiprocess architectures of the browsers are a bit more complex than that, but this is the gist of things.

As of Firefox 57 and up on Linux,1 the release branch of Firefox uses the same core functionalities Chrome does for sandboxing. Both browsers use seccomp-BPF to limit content process syscall access for reducing attack surface, and the content (child) processes of both browsers are sandboxed either by a setuid wrapper (Chrome legacy fallback) or unprivileged user namespaces (Firefox and Chrome on modern kernels).2,3

Thus, from a high-level perspective, the sandboxes of Firefox and Chrome are equivalent in strength.

| improve this answer | |

As Ramhound pointed out, Firefox does have script runtime sandboxes, but Firejail is something else entirely. Neither Chrome nor Firefox attempt to do what Firejail does.

Firejail is not a script runtime sandbox as they are commonly built into browsers, but is instead a Mandatory Access Control layer outside the browser entirely, like Selinux or Novell AppArmor. It isolates the entire browser (or other non-browser processes), not just specific areas within the browsers runtime components, so you can set limits on the browsers impact to your system in the case that the browsers sandbox is broken by new attacks, or the user does something abysmally stupid. You could do stuff like assert that a process can only access certain resources, and will block any other operations.

Personally, If I needed an MAC layer for my browser, I'd use SELinux or AppArmor (which ever is preferred by the maintainers of my distro), or even better, a virtual machine for complete isolation.

| improve this answer | |