Project Fission - Firefox site isolation coming later this year

The Firefox platform team has been working on a new security architecture that isolates sites from each other, down to separating cross-origin iframes from the tab’s process. This new model, nicknamed Fission, is currently available for opt-in testing in Nightly. The platform team is planning to begin roll-out to Nightly and Beta users later this year.

So far, we have identified two changes with Fission enabled that will impact extensions:

  • Content scripts injecting extension iframes (from a moz-extension:// url) and accessing them directly via the .contentWindow property will be incompatible with Fission, since that iframe will run in a different process. The recommended pattern, as always, is to use postMessage and extension messaging instead.

  • The synchronous canvas drawWindow API will be deprecated, since it’s unable to draw out-of-process iframes. You should switch to the captureTab method, which we are looking to extend with more functionality to provide a sufficient replacement.

If you are the developer of an extension that uses one of these features, we recommend that you update your extension in the coming months to avoid potential breakages.

We’re working to make the transition to Fission as smooth as possible for users and extension developers, so we need your help: please test your extensions with Fission enabled, and report any issues on Bugzilla as blocking the fission-webext meta bug. If you need help or have any questions, please post in this thread, or come find us on Matrix.

We will continue to monitor changes that will require add-ons to be updated. We encourage you to follow our blog to stay up to date on the latest developments. If more changes to add-ons are necessary we will reach out to developers individually or announce the changes here.

3 Likes

I’ve just tested the new pref “fission.autostart=true” and it breaks screenshots in my addon - the content of iframe is not visible on the screenshot. Is this excepted behavior?

To be clear:
I have a extension page with an iframe(s) that loads some http page. When I use " tabs.captureTab", it should take screenshot of the tab including the content of iframe, right?

Thank you for testing Juraj. Yes, Screenshots are also broken, due to the same issue with the canvas drawWindow API. We’re working on that, and you can follow progress in bug 1636508.

1 Like

Thanks @zombie, I coudn’t find it in the list of blocking issues for the 1573488. Is there a reason for that?

No reason, just missed to connect it, recently we’ve been mostly using milestones for tracking.

1 Like

Thanks @zombie!
One more question, is Fission enabled on Fenix?
I’ve been testing my addon there and it seems to have the same issue.