Fission (site isolation)

Fission is the project that splits the renderer per eTLD+1 so different origins live in different content processes — even within a single tab when iframes are cross-origin. It mitigates Spectre-style cross-origin leaks and aligns Firefox with the threat model used by other modern browsers.

What changed

Before Fission, a Firefox tab corresponded to a single content process; iframes from third-party origins ran in the same process as the top-level page. With Fission, every cross-origin frame is hosted by its own out-of-process content process, with parents/children stitched together via IPC.

Implementation surface

• BrowsingContext (docshell/base/BrowsingContext.h, docshell/base/CanonicalBrowsingContext.h) — replication and synchronization across processes.
• WindowGlobalParent / WindowGlobalChild (dom/ipc/WindowGlobalParent.h, dom/ipc/WindowGlobalChild.h) — per-document IPC actors.
• JSWindowActor (dom/ipc/JSActor.cpp) — declarative scriptable IPC; the dominant pattern for browser chrome to drive content.
• OOP iframes — implemented via nsFrameLoader + BrowserBridgeChild / BrowserBridgeParent, which marshal layout/painting between processes.
• Process picker in dom/ipc/ContentParent.cpp — chooses or pre-warms the right process for a given navigation.

Cross-process surfaces that had to change

API	Old behavior	Under Fission
window.parent.foo	Synchronous direct access	Cross-origin: synchronous null/throws; same-origin: handled via window proxy
postMessage	Same process	Routed across IPC
Storage events	Process-local broadcast	Synced via parent
document.domain	Mutable host check	Largely vestigial; cross-origin still isolated

Tuning

• fission.autostart — global toggle.
• dom.ipc.processCount.webIsolated — pool size for Fission processes.
• fission.webContentIsolationStrategy — controls how aggressively to isolate.

Related

• Process model
• DOM
• Sandboxing