Lock javascript.options.spectre.disable_for_isolated_content to false

Link: https://bugzilla.mozilla.org/show_bug.cgi?id=1774178

I suspect we will want to lock this pref and prevent users from reducing their security, would need to be looked into.

added 13.0 stable Code Audit Security FF115-esr labels

assigned to @ma1

marked this issue as related to tor-browser-spec#40052 (closed)

That would definitely be a foot-gun for our users, only reason for disabling those mitigations would be either testing/debugging or performance pursuit, neither of which apply to us.

So, the rationale behind this is that Fission content processes are isolated on per-site basis, hence they're themselves a mitigation with trade-offs of their own, but would at least eliminate the need for the performance overhead of Spectre-specific mitigations.

However, in the spirit of defense-in-depth, I would lock this preference to false (as it currently is in Firefox stable) until 128ESR at least, to wait and see how reliable the above assumption is (i.e. revisit after it gets turned to true upstream).

mentioned in merge request !723 (merged)

added Next label

marked this issue as related to tor-browser-build#40915 (closed)

marked this issue as related to tor-browser-build#40914 (closed)

closed

changed title from Review Mozilla 1774178: Add a pref to disable Spectre mitigations for Fission web content processes to Lock javascript.options.spectre.disable_for_isolated_content to false

marked this issue as related to tor-browser-build#40965 (closed)

marked this issue as related to tor-browser-build#40966 (closed)

Keeping false as defense-in-depth, but unlocking in #42356 (closed) since it's been enabled in Firefox 119 (https://bugzil.la/1851162).

mentioned in merge request !1249 (merged)