Firefox 95 Ready With RLBox Sandboxing Across All Platforms

Mozilla Firefox 95.0 is now available for download ahead of its official release tomorrow. Making this new version interesting is the RLBox integration.

Across all platforms the Mozilla Firefox 95.0 web browser is now using RLBox to protect against security vulnerabilities within third-party libraries.

RLBox is designed to sandbox third-party libraries and is made up of a WebAssembly-based sandbox and an API for retrofitting existing application code within the sandboxed library. RLBox will isolate the memory of the sandboxed library from that of the application/Firefox, among other security benefits.

RLBox

RLBox is explained in more detail via the documentation on GitHub. There is also this blog post on Mozilla Hacks outlining this WASM-based sandboxing effort. (Update: Mozilla also has out now another blog post on this RLBox sandboxing tech.)

This RLBox WebAssembly sandboxing code isn't specific to Mozilla/Firefox but can also be used by other arbitrary applications. RLBox was originally designed by researchers from UC San Diego as well as University of Texas at Austin and Stanford University. Over the past year and a half Mozilla has been working to incorporate RLBox into Firefox and now for Firefox 95.0 it's reached the milestone of being used across platforms for fending off issues caused by third-party libraries.

Firefox 95 also now supports the "inputmode" global attribute across all platforms (previously it was only Android), the CSS cursor property is now supported on Android, and a CPU usage reduction by avoiding always posting an NSEvent to the event loop every-time a non-native event is ran. That CPU usage reduction should also help in battery life besides being a win by itself.

While awaiting the official announcement, Firefox 95 can be downloaded from Mozilla.org.