bi-02 — Analysis
The generating invariant
A renderer process is assumed to be compromised.
Nearly every structural decision in Chromium is downstream of this one sentence. When a design looks paranoid, check it against this before concluding it is over-engineered.
Required invariants
- Same principal + same browsing context group ⇒ same process. Not a performance heuristic:
such documents have synchronous access to each other (
document.domain,SharedArrayBuffer), and splitting them would produce data races across two heaps. - The browser process validates everything a renderer says. A renderer can lie about its
origin;
ProcessLockis what makes the lie useless. - Ordering is guaranteed per Mojo pipe and not across pipes. Code assuming cross-interface ordering is assuming something no layer promises.
- Privileged capability is delegated as an endpoint, not granted by a check. The browser hands out a scoped ability rather than answering "may I?" repeatedly.
- Rule of Two: untrustworthy input + unsafe language + no sandbox — at most two.
Failure modes this architecture is designed against
| Threat | Defence | What it costs |
|---|---|---|
| Renderer exploit reads another site's data | site isolation; data never enters the process | memory, ~1 process per site |
| Speculative-execution side channel | same — "never delivered" beats "checked" | the entire CORB/ORB layer |
| Compromised renderer lies about identity | ProcessLock enforcement | validation code in every browser-side handler |
| Malicious framing | frame-ancestors/XFO enforced browser-side | cannot be done in the framed renderer |
| Driver bug or GPU exploit | separate GPU process | an extra process, an extra hop |
The trade nobody can escape
Process-per-site costs real memory, which is why it shipped on desktop first and why Android uses reuse heuristics. An argument for "isolate everything, always" is an argument for a browser that loses on low-end devices — which is most devices. The interesting question is never "is isolation good" but "what is the memory budget on the worst device we support."
What would falsify the model
If a same-site cross-origin pair could be safely split across processes, the principal could be an
origin and the model would simplify enormously. It cannot, because of document.domain and shared
memory — which is exactly why Origin-Agent-Cluster exists: opt out of the synchronous access,
and origin-keyed isolation becomes available. The escape hatch proves the rule.