Blaming process isolation and IPC for memory bugs like Use-After-Free and dangling pointers fundamentally confuses language-level C++ problems with OS containment architecture. Memory corruption exists across all C++ engines (Gecko, WebKit, Blink); isolation is what prevents those bugs from compromising the host OS.

Yeah, but they instead greatly compromise the browser, and the problem is that these are not as likely to happen in MV2 (i.e., Firefox).

Why? Simple:

1. You have a long operation running inside an extension.
2. Your system (or the browser itselfs) suspends or even kills the associated Service Worker.
3. A new one has to be created.
4. If the previous memory chunk goes unreferenced, then you have a double free and/or an UAF.
5. If the previous memory chunk doesn’t get unreferenced, then you get a dangling pointer.
6. Either way you get a race condition if it’s something concurrent.

The problem is, if an attacker and/or a malicious process do compromise that unreferenced or unallocated memory, then any and all sandboxing will be esentially irrelevant and thus vulnerated, vulnerating not only the browser (something that itself can compromise sensible information), but even the OS.

Then you have the zombie processes because the current memory model in V8 causes SWs to forcedly stop before they can do any cleanup.

MV3 is not about security at all, is about more control over your own computer and about more control over the network (that way they can let more trackers, zero-days, ads, malvertisers and even malware to pass because browser-level blockers and firewalls won’t be able to block them).

Edit: MV3 is a perfect example of inverse tivoization.