chrome://sandboxįirst you’ll see a table of active processes (excluding the browser process, as that is not sandboxed) and some summary information:-įollowed by a raw dump of every process’s detailed sandbox configuration in JSON, which we’ll look at later.ĭepending on how many tabs you have open, and which plugins or extensions you’re running, you’ll see something similar. Below, we’ll use the output of chrome://sandbox to show some of these restrictions. The goal of the sandbox is to allow these processes the level of access to the operating system they need to do their jobs, and nothing more. The browser is supported by network, audio and gpu processes, and uses short-lived data-decoder and utility processes to parse and verify complex data formats. Chrome calls the processes running sites renderers and its main coordinating process the browser. This way, a bug or a crash in the process running one site will not bring down other sites, and data in one process can be made inaccessible to other processes. To provide a secondary layer of defense Chrome restricts what it can do by containing sites and services in sandboxed processes.Ĭhrome uses a multi-process architecture for security and stability. This, in turn, could allow an attacker to do anything Chrome can, such as accessing a user’s files, or calling Windows APIs, which may themselves have exploitable bugs. However, Chrome has a JavaScript engine and parsers for complex data formats written in C/C++ for performance, which may have bugs that a malicious attacker can exploit to run arbitrary code. Chromium developers mainly achieve this by writing secure code, testing, and fuzzing. Chromium has to protect itself from malicious sites, and protect each site’s data from being accessed by other sites. Users visit more than one site in each browsing session, and each site might include components from a range of third parties.

Users visit sites that store sensitive information, serve complex data formats and run JavaScript code. This post will outline how the sandbox works on Windows and the information that is displayed.Ĭhrome, and all web browsers, have a difficult job. The output is mainly of interest to Chromium developers but, along with chrome://conflicts, could be helpful when troubleshooting incompatibility between misbehaving software and the sandbox. You can access this by typing chrome://sandbox into the url-bar (Omnibox). The latest Chrome stable release for Windows, Chrome 80 (early February 2020) provides detailed debugging information on how Chromium’s processes are sandboxed.

Windows 10 sandbox mode missing