Understanding Chromium's Rule of Two Security Principle

This article provides a comprehensive breakdown of the "Rule of Two," a core security principle used by Chromium engineers when developing new browser features. It explains the three primary risk factors in software development—untrusted input, unsafe programming languages, and high privileges—and demonstrates how limiting new code to no more than two of these factors prevents critical security vulnerabilities like remote code execution.

The Core Concept

When developing new features for the Chromium web browser, engineers must adhere to a strict security guideline known as the Rule of Two. The principle states that any given piece of code may satisfy no more than two of the following three conditions at the same time:

  1. It processes untrusted input.
  2. It is written in an unsafe language.
  3. It runs with high privileges.

If a new feature requires all three conditions simultaneously, it is considered an unacceptable security risk and cannot be shipped without architectural changes.

Breaking Down the Three Conditions

To understand how the rule is applied, it is necessary to define the three risk factors in the context of web browser architecture:

  • Untrusted Input: Data that originates from the open internet or an unverified source. In a browser, this includes HTML, CSS, JavaScript, images, fonts, and network packets. Because an attacker can easily manipulate this data, it is always considered hostile.
  • Unsafe Language: Programming languages that lack memory safety, primarily C and C++. Chromium is predominantly written in C++. In these languages, programmer errors can easily lead to memory corruption bugs, such as buffer overflows or use-after-free vulnerabilities, which attackers exploit to hijack the software.
  • High Privileges: Code that runs without restrictions, having direct access to the user's operating system, file system, hardware, or sensitive data across different websites. In Chromium, the main "Browser Process" runs with high privileges, whereas "Renderer Processes" run inside a restrictive security sandbox (low privilege).

How Engineers Apply the Rule

Because the fundamental purpose of a web browser is to process data from the internet, dealing with untrusted input is usually unavoidable. Furthermore, because Chromium's codebase is largely C++, using an unsafe language is often the default.

To comply with the Rule of Two, engineers must actively design features so that at least one of the three conditions is eliminated. This results in three acceptable development patterns:

1. Untrusted Input + Unsafe Language = Must Use Low Privilege

This is the most common approach in Chromium. If an engineer writes C++ code to parse untrusted data (like a new image format), that code must be isolated inside a strict sandbox. If an attacker exploits a memory bug in the C++ code, the sandbox prevents them from accessing the rest of the computer or reading data from other websites.

2. Untrusted Input + High Privilege = Must Use a Safe Language

If a feature must run in the high-privilege Browser Process and handle untrusted data, it cannot be written in C or C++. Instead, engineers must use a memory-safe language such as Rust, Java (on Android), or JavaScript. Memory-safe languages automatically prevent the memory corruption bugs that attackers rely on to compromise the system.

3. Unsafe Language + High Privilege = Must Use Trusted Input

If C++ code must run in the high-privilege Browser Process, it may only interact with data that has already been vetted and sanitized. Typically, this means a low-privilege, sandboxed process takes the untrusted input, parses it, verifies its safety, and repackages it into a structured, safe format before handing it off to the high-privilege process.

Why the Rule of Two Matters

The Rule of Two is a pragmatic defense-in-depth strategy. It acknowledges that humans will inevitably write bugs in C++ and that attackers will inevitably send malicious data to the browser. By strictly separating high privileges from the combination of unsafe code and untrusted data, Chromium ensures that a single coding error does not result in a complete compromise of the user's device.