bi-02 step 02 — Trust boundaries in practice

Goal

Locate, in source, three places where the browser process refuses to trust a renderer — and state what an attacker gets if each check is removed.

Tasks

1. Read the threat model. Read docs/security/compromised-renderers.md. Its section list is an inventory of what a compromised renderer must not obtain. Pick three sections that surprise you.

2. Find an enforcement point. Locate where frame-ancestors / X-Frame-Options is enforced. Confirm it is browser-side and explain why it cannot be enforced in the framed renderer.

3. Find a validation site. Open a browser-side Mojo interface implementation. Identify the validation it performs on renderer-supplied data. Find its test that feeds invalid input — that test is the compromised-renderer model expressed as code.

4. Read the Rule of Two. Read docs/security/rule-of-2.md. Find one utility process that exists because of it, and say which of the three conditions it drops.

5. Cookies. Explain, in three sentences, why HttpOnly is meaningful given that document.cookie exists — using process boundaries, not JavaScript.

Done when

• Three surprising entries from the threat model recorded
• One browser-side enforcement point located with its rationale
• One Mojo validation test found
• You can explain why "the checks stop it" was insufficient after Spectre