2008559 - [meta] Type checking for JS IPC messages

Status: NEW

(Core :: DOM: Content Processes, task)

Description

[Andrew McCreight [:mccr8]]

There are two forms of JS IPC, JS actors and message manager. With both of these, you can send whatever JS value you want as the data portion of your message. The receivers in the parent process usually aren't trying to deal with malicious messages, and so due to some odd corner cases of JavaScript, this can sometimes be leveraged to carry out a sandbox escape. This was used in two separate, but related, Pwn2Own exploits.

In practice, most of these messages are quite simple, little more than JSON. If we require developers declare what sort of JS value they are expecting, using a TypeScript-like type language, then we can dynamically type check the messages, making these sorts of exploits much harder to create.