Firefox Fission aims to thwart nasty Spectre-style attacks

The "massive" project's first milestone should be complete this month.

Stephen Shankland Former Principal Writer
Stephen Shankland worked at CNET from 1998 to 2024 and wrote about processors, digital photography, AI, quantum computing, computer science, materials science, supercomputers, drones, browsers, 3D printing, USB, and new computing technology in general. He has a soft spot in his heart for standards groups and I/O interfaces. His first big scoop was about radioactive cat poop.
Expertise Processors | Semiconductors | Web browsers | Quantum computing | Supercomputers | AI | 3D printing | Drones | Computer science | Physics | Programming | Materials science | USB | UWB | Android | Digital photography | Science Credentials
  • Shankland covered the tech industry for more than 25 years and was a science writer for five years before that. He has deep expertise in microprocessors, digital photography, computer hardware and software, internet standards, web technology, and more.
Stephen Shankland
3 min read
A Firefox Nightly sticker

A Firefox Nightly sticker

Stephen Shankland/CNET

With a Firefox effort called Project Fission, Mozilla is moving ahead this month with a plan to keep a major class of computer attacks at bay.

The Spectre and Meltdown attacks, more broadly called side-channel attacks, have been a major issue for the computing industry since they emerged a year ago. Mozilla fixed the immediate security vulnerabilities in Firefox last year, but now with an overhaul called Project Fission, the company hopes to protect the browser from any future Spectre-class variations.

Fission has been underway for months. But Mozilla plans to take its first concrete step later this month with a release called Milestone 1, said Nika Layzell, a Firefox platform engineer, in a blog post Monday.

"We aim to build a browser which isn't just secure against known security vulnerabilities, but also has layers of built-in defense against potential future vulnerabilities," Layzell said. "Fission is a massive project."

Spectre-style attacks can be used to steal highly sensitive data like passwords or encryption keys not just by exploiting web browsers but also processors and operating systems. The computing industry has been scrambling to fundamentally redesign much of its technology as a result. The magnitude of Project Fission shows just how hard it is to take care of the problem.

Mozilla isn't yet ready to say when Fission will be done. But it'll start shipping its elements in the Firefox Nightly test version of the browser when it's ready.

"Project Fission changes the Firefox browser architecture to make it even more secure and resilient to security vulnerabilities. We are defining early project milestones and sharing them so that people interested in Firefox development can follow along," the nonprofit said in a statement Tuesday.

Following up on Firefox Electrolysis

Project Fission is something of a sequel to Mozilla's earlier Electrolysis project, which split some parts of Firefox into separate computing processes to improve security and performance. In scientific terms, electrolysis can split molecules into separate atoms, for example turning water into hydrogen and oxygen.

But fission splits individual atoms, and as the term suggests, Project Fission involves a lower-level change than Electrolysis.

Specifically, Project Fission enables a technology called site isolation that can split even individual websites into separate computing processes. Google already enabled site isolation in its Chrome browser after a years-long research project that turned out to bear fruit when Spectre emerged.

More memory

One drawback of site isolation is that it requires more memory. Mozilla had hoped its Electrolysis plan would offer a memory advantage over Chrome, but the need for site isolation wiped out that expectation. To try to contain browser bloat, though, Mozilla has a related project called Fission Memshrink.

"We are working to ensure Firefox users continue to experience best-in-class memory usage and performance," Mozilla said in a statement Tuesday.

Fission won't arrive in one single update. "Each milestone will contain a collection of new features and improved functionality which brings us incrementally closer to our goal," Layzell said of the project.

First published Feb. 5, 2:23 p.m. PT.
Update, 3:40 p.m. PT: Adds further detail from Mozilla.

CNET Magazine: Check out a sample of the stories in CNET's newsstand edition.

Taking It to Extremes: Mix insane situations -- erupting volcanoes, nuclear meltdowns, 30-foot waves -- with everyday tech. Here's what happens.