This bug is filed to investigate/prototype sandboxing the parent process. It may be that attempting to sandbox the parent process is not practical or worth the effort, but it's worth considering. Some things that might be possible: 1) limiting what the browser can spawn/execute to files in read-only locations such as /Applications (or equivalent for other platforms) 2) limiting where the browser can write to on the filesystem--could it be limited to ~/Downloads, profile data, and selections from file save dialogs? 3) enforcing all network traffic goes through a proxy As we move more functionality out of the parent process to lower privileged processes, sandboxing the parent becomes less beneficial because the parent process does less and is presumably easier to audit/more secure. Some Mac-specific notes: a child of a sandboxed process can not install a new sandbox profile so this would require a new process that spawns (what we today call the) parent and all its child processes. It's likely we would always have a launcher process that isn't running sandboxed. To experiment, one could disable all sandboxing in child processes and then start the browser sandboxed. Or, implement a spawner process that is resposible for launching all processes and deal with any issues there first without applying any sandboxing to the parent to validate that a grandparent launcher process can work.

There's some overlap with what's discussed on 1380335. Added as a see also.

(In reply to Haik Aftandilian [:haik] from comment #0) > Some Mac-specific notes: a child of a sandboxed process can not install a > new sandbox profile so this would require a new process that spawns (what we > today call the) parent and all its child processes. Maybe we wouldn't have to add a new launcher process. We should be able to use macOS's launch services to launch content processes on behalf of the parent process without having to write a new launcher process. That would allow content processes to keep their more restrictive sandbox policies while using a different policy for the parent.