July 24, 2026
Browser jailhouse rock
Mohabi: Disaggregating and Sandboxing the Firefox JavaScript Engine
Firefox puts JavaScript in a locked room, and commenters are split on whether it’s genius or a slowdown nightmare
TLDR: Mozilla-backed researchers built a version of Firefox that locks website code into a safer compartment, making browser bugs less dangerous at the cost of some speed. Commenters are split between applauding the safety upgrade and roasting the claim that a roughly 25% benchmark hit is “modest.”
Firefox’s latest research project, Mohabi, sounds simple in plain English: take the part of the browser that runs website code and stick it in a secure little box so if it breaks, it can’t trash the rest of the app. Researchers say they pulled off this massive browser makeover with only a moderate speed hit. And yes, that’s where the comments immediately caught fire.
The biggest cheerleading camp called it exactly the kind of boring, unsexy safety work the web desperately needs. Their vibe: if one buggy website can’t take down your whole browser, that’s a win, full stop. But the skeptics were just as loud, zooming in on the roughly 25% slowdown in popular browser speed tests and basically yelling, “A quarter slower is ‘modest’ now?” That one word — modest — became the real comment-section battleground.
Then came the classic browser drama. Some people praised Mozilla for doing ambitious safety engineering while others joked that Firefox is becoming the “organic, free-range browser” — healthier for you, maybe, but not exactly built for drag racing. A few commenters turned it into meme material, imagining JavaScript in browser jail, getting frisked before touching memory. Others argued this is the future: users won’t notice benchmarks nearly as much as they’ll notice crashes and security disasters. In other words, the research is impressive — but the community is having a very loud, very internet argument over whether safer should also mean slower.
Key Points
- •Mohabi is a modified Firefox browser designed to securely sandbox the SpiderMonkey JavaScript engine.
- •The project uses software-based fault isolation to prevent JavaScript engine bugs from affecting the rest of the browser.
- •The researchers disaggregated SpiderMonkey from Firefox and used type-system-based techniques plus automatic code generation to support the transformation.
- •Mohabi reports benchmark overheads of 24.82% on JetStream and 24.43% on Speedometer.
- •The article states that Mohabi is the largest case study yet in retrofitting in-process sandboxing into a large system, and its x86-64 SFI toolchain shows 5.9%–6.6% overhead in SPEC 2017.