Mozilla browser still trails the rest when it comes to sandboxing Web content.
Firefox 48 shipped today with two long-awaited new features designed to improve the stability and security of the browser.

After seven years of development, version 48 is at last enabling a multiprocess feature comparable to what Internet Explorer and Google Chrome have offered as stable features since 2009. By running their rendering engines in a separate process from the browser shell, IE and Chrome are more stable (a Web page crash does not take down the entire browser) and more secure (those separate processes can run with limited user privileges). In order to bring the same multiprocess capability to Firefox, Mozilla started the Electrolysis project in 2009. But the organization has taken substantially longer than Microsoft, Google, and Apple to ship this feature.

Mozilla's delay was partly driven by changing priorities within the organization—Electrolysis development was suspended in 2011 before being resumed in 2013—and partly because Firefox's historic extension architecture made this kind of separation much harder to achieve. Traditional Firefox extensions can invasively meddle with parts of the browser and assume equal access both to the rendering engine and to the browser's shell. Firefox's developers had to both create a new extension system (they've ended up using HTML-and-JavaScript based extensions closely related to those pioneered by Chrome and also adopted by Edge) and create shim layers to offer developers a temporary way to continue to support their old extensions.

Even after all this time, Firefox's multiprocess system is not a match for its peers. The rollout of Electrolysis is being handled conservatively in spite of a successful beta. For the next few days, only a fraction of a percent of Firefox 48 users will have Electrolysis turned on by default. If this mini-rollout goes well, the multiprocess feature will be rolled out to about half of all Firefox 48 users and will be extended to handle extensions known to be compatible in Firefox 50. Electrolysis will be rolled out to Firefox 51 users with touchscreen devices, right-to-left languages, and disabled accessibility software, making it available to most Firefox users.

Firefox's multiprocess feature will still fall short of what Edge, Chrome, and Safari do, as it will use a single process for every tab. Those other browsers tend to use one process for one, or perhaps a small handful, of tabs. Using one process for multiple tabs not only protects the browser shell in the event of a crash; it also avoids any contagion between tabs. Running multiple tabs with one process also prevents data leaks between tabs. Electrolysis is due to be rolled out in the first half of 2017. After that is done, the extensions will be moved to separate processes too.

As much as Firefox lags in this area, it's cutting edge in another. Mozilla's Rust language is designed to give the same level of performance and control as C++, but without C++'s susceptibility to security flaws. The company has developed Rust code to replace the C++ code which currently handles complex media formats. This replacement code is now shipping in the stable version of Firefox 48.

Thanks for information