Sandbox
A sandbox is an isolated environment that restricts code execution permissions, letting untrusted code access only limited resources and limiting the impact of vulnerabilities.
Purpose
To isolate untrusted code (plugins, third-party scripts, sandboxed iframes) and restrict its privileges; defense in depth.
Mechanism
OS-level sandboxes (seccomp, chroot, namespace) restrict syscalls and file access; browser iframe sandbox restricts scripts/forms/popups; language sandboxes (WASM, V8 isolate) restrict memory access.
Use cases
- Untrusted code isolation
- Browser security
- Defense in depth