State of Browser Process-Isolation: The Same-Site Weakness

Web browsers are among the most sophisticated and essential software tools we use in everyday life. Due to their complexity, however, their attack surface is large and encompasses a broad class of vulnerabilities. To protect against a large class of advanced exploitation techniques, browsers have adopted site isolation, which protects users by isolating websites and their sensitive information into separate processes out of reach for an attacker. However, due to initial compatibility issues, subdomains are not isolated from each other. This creates a serious security risk, as attackers frequently hijack subdomains and exploit them to launch malicious campaigns. In this paper, we study the risks of current renderer process isolation policies and show that attackers can exfiltrate sensitive data across all major browsers. First, we analyze the design of process isolation across browsers and evaluate how the assignment of web origins to processes is influenced by existing mitigation headers. Through this analysis, we uncover several flaws in the implementation of these mitigations and introduce novel techniques to force domains in the same process. Next, we evaluate which type of in-process attacks pose viable threats by presenting exploitation case studies on the Blink, Gecko, and WebKit browser engines and measuring their performance. Our case studies demonstrate that, because only small amounts of data need to be leaked, even Spectre v1 can be employed, highlighting that nearly all modern machines are at risk. We assess the adoption of mitigation headers by scanning websites from the top 25,000 entries in the Tranco ranking as well as subdomains of academic institutions. Our analysis reveals that only 6 % of Tranco-ranked domains and fewer than 2 % of university websites enable any relevant mitigation. To evaluate the performance of stricter process isolation policies, we benchmark Chrome's prototypes implementing origin isolation using Speedometer 3.0 and conduct a case study on the top 12 reachable websites from the Tranco ranking. Overall, we conclude that in-process attacks still pose a significant threat; however, browsers can enforce stricter policies with low overhead and no compatibility issues for most websites.