**Episode 5:** by Ade in Mountain View, CA (August, 2019)  

[Previous episodes](https://developer.chrome.com/docs/chromium/chronicle)

Chrome is split into processes. Some of them are sandboxed, which means that
they have reduced access to the system and to users' accounts. In a sandboxed
process, bugs that allow malicious code to run are much less severe.

**The browser process has no sandbox**, so a bug could give malicious code full
access to the whole device. What should you do differently? And what's the
situation with other processes?

![Sandbox diagram](https://developer.chrome.com/static/blog/chromium-chronicle-5/image/sandbox-diagram-cb2970d9cdd56.png)

**All code has bugs.** In the browser process, those bugs allow malicious code
to install a program, steal user data, adjust computer settings, access content
of all browser tabs, login data, etc.

**In other processes, OS access is limited** via platform-specific restrictions.
For more information, see Chrome's [sandbox implementation guide](https://chromium.googlesource.com/chromium/src/+/master/docs/design/sandbox.md).

Make sure to avoid the following common mistakes:

![rule of two](https://developer.chrome.com/static/blog/chromium-chronicle-5/image/rule-two-8287abbfd7248.jpg)

- **Don't parse or interpret untrustworthy data using C++ in the
  browser process.**
- Don't trust the origin a renderer claims to represent. The browser's [RenderFrameHost](https://cs.chromium.org/search/?q=RenderFrameHost&sq=package:chromium&type=cs) can be used to get the current origin securely.

<br />

Do

Instead, use the following best practices:

- Be extra paranoid if your code is in the browser process.
- Validate all IPC from other processes. Assume all other processes are already compromised and out to trick you.
- Do your processing in a renderer or utility process or some other sandboxed process. Ideally, also use a memory safe language such as JavaScript (solves \>50% security bugs).

For years, we ran network stacks (e.g. HTTP, DNS, QUIC) in the browser process,
which led to some [critical vulnerabilities](https://bugs.chromium.org/p/chromium/issues/list?q=type%3Dbug-security+component:Internals%3ENetwork+status:fixed,verified+security_severity%3Dcritical&can=1). On
some platforms, networking now has its own process, with a sandbox coming.

## Additional Resources

- [Chromium's Rule of Two](https://chromium.googlesource.com/chromium/src/+/master/docs/security/rule-of-2.md): no more than two of unsafe data, unsafe code, and unsafe process.
- [Validating IPC Data](https://chromium.googlesource.com/chromium/src/+/HEAD/docs/security/mojo.md#Validate-privilege_presuming-data-received-over-IPC): a guide on how to ensure that IPCs from the renderer process are not full of fibs and misrepresentations.