Firefox's Fission project (also called Site Isolation) fundamentally changed how Firefox handles process separation. It's now fully enabled by default, but understanding it helps explain some Firefox behavior.
What Fission Does
Before Fission: Firefox used a multi-process architecture called e10s (Electrolysis), where the browser UI ran in one process and web content ran in content processes. Multiple tabs could share a content process.
After Fission: Each site origin gets its own isolated process. mail.google.com runs in a different process than docs.google.com, even though they're both under google.com. An iframe from evil.com embedded in trusted.com runs in its own separate process.
Why It Matters for Security
The main motivation: Spectre and Meltdown hardware vulnerabilities (2018). These side-channel attacks allow a process to read memory from other processes on the same CPU core.
Without site isolation:
- A malicious site embedded in an iframe could potentially use Spectre to read memory from other origins in the same process
- Cross-origin data (authentication tokens, credentials, user data) could leak
With Fission:
- Each origin is isolated in its own process
- Even if a site exploits Spectre, it can only read its own process memory
- Cross-origin iframe data is in a separate process → not directly accessible
What Changed for Users
Memory usage: More processes = more memory overhead. This is real. Each isolated site needs its own process (+ memory for process overhead). Firefox's memory usage increased after Fission.
Mitigation: Firefox limits concurrent processes via dom.ipc.processCount. The default adapts to available RAM.
Performance: Generally neutral to positive. Sites don't block each other's processes. A slow/stuck tab doesn't slow down other tabs.
Crash isolation: A content process crash (plugin, complex JavaScript, memory issue) now affects fewer tabs. With full isolation, only the crashed site's tabs are affected.
Checking Fission Status
about:support → Multiprocess Windows → should show "1/1 (Enabled by Fission)"
Or check: about:config → fission.autostart — should be true.
Fission and Extensions
Extensions run in their own process (extension process). This means extension code is isolated from web content. Extensions communicate with content scripts via message passing, not shared memory.
One implication: some extension APIs that relied on same-process behavior changed. Extension developers had to update their code for Fission compatibility. Most modern extensions (as of 2023+) handle this correctly.
Performance Settings Related to Fission
dom.ipc.processCount — Maximum number of content processes. Default varies by RAM.
- 4GB RAM: ~4 processes
- 8GB RAM: ~8 processes
- More RAM: up to 20 processes
If you have lots of RAM and many tabs, increasing this can improve isolation. If you're RAM-limited, decreasing it reduces memory pressure.
dom.ipc.processCount.webIsolated — Process count specifically for Fission-isolated origins. Defaults to 4.
Total Cookie Protection (Fission Companion)
Alongside Fission (process isolation), Firefox also implemented Total Cookie Protection (TCP): each top-level site gets its own "cookie jar." Cookies set by tracker.com on site-a.com can't be read by tracker.com when you later visit site-b.com.
This is a data layer isolation complementing Fission's process layer isolation. Together they significantly limit cross-site tracking and data leakage.
Verifying Isolation in Practice
In DevTools (Ctrl+Shift+I), open the Performance panel. You can observe the process structure — you'll see separate processes for different origins.
In about:processes, Firefox shows all running processes with their types and memory usage.
When Things Break
Fission very occasionally causes compatibility issues with older extensions or poorly-coded web pages that assumed same-process behavior. Signs of a Fission-related issue:
- Content works in non-Fission mode
- Extension stops working in some contexts
- Cross-origin communication behaves unexpectedly
To test: about:config → fission.autostart = false → restart Firefox. If the issue disappears, it's Fission-related.
Fission represents a significant security improvement, comparable to Chrome's site isolation (which landed earlier). The memory tradeoff is real but manageable on modern hardware. For most users, it's invisible — you just get better security with no action required.
Top comments (0)