Safari Security: Site Isolation and Per-Tab Sandboxing

This article provides an overview of how the Safari web browser utilizes per-tab sandboxing and site isolation to defend users against web-based cyber threats. By separating web content into tightly restricted, independent processes, Safari ensures that a malicious website cannot access local operating system resources or steal sensitive data from other open tabs and domains.

The Multi-Process Foundation

Safari relies on the WebKit browser engine, which uses a multi-process architecture. Instead of running the entire browser as a single application on your device, Safari divides its workload into distinct, specialized processes. There is a main UI process that manages the browser interface, a network process that handles internet traffic, and multiple "WebContent" processes dedicated to rendering webpages. This separation is the foundation for both sandboxing and site isolation.

How Per-Tab Sandboxing Protects the Operating System

Per-tab sandboxing is designed to protect your device's operating system (macOS or iOS) from untrusted code running on a webpage. When you open a new tab in Safari, the browser places that tab’s WebContent process inside a strict, OS-level sandbox.

This sandbox strips the webpage of all system privileges, preventing malicious websites from accessing operating system resources through the following mechanisms:

• Blocked File System Access: A sandboxed tab cannot read, write, or modify files on your hard drive. It has no awareness of your personal documents, photos, or system files.
• Hardware Restrictions: The sandbox blocks direct access to hardware components like the camera, microphone, and location services.
• Kernel Protection: The sandboxed process is barred from making direct system calls to the operating system's kernel, preventing attackers from exploiting OS-level vulnerabilities to take control of the device.
• Brokered Permissions: If a legitimate website needs to access a file (for an upload) or use the webcam, the sandboxed tab cannot do it alone. It must send a request to Safari's main process using tightly controlled Inter-Process Communication (IPC). The main process acts as a security broker, prompting you for explicit permission before passing only the approved data back into the sandbox.

If a malicious website manages to exploit a vulnerability in Safari's rendering engine, the attacker is trapped inside that specific tab's sandbox. They cannot install malware on the device, and the moment you close the tab, the process is terminated and the threat is erased.

How Site Isolation Protects Data From Other Domains

While sandboxing protects the operating system from the browser, site isolation protects websites from each other.

Historically, browsers isolated processes by tab. However, a single webpage often loads content from multiple domains, such as third-party advertisements, social media buttons, or embedded videos (via iframes). If a malicious third-party ad shared the same process as the primary webpage, it could use hardware-level side-channel attacks (like Spectre) to read the memory of that process and steal passwords, session cookies, or credit card numbers.

Safari uses site isolation to enforce the Same-Origin Policy at the process level, preventing cross-domain data theft in several ways:

• Process-Per-Domain Separation: Instead of just isolating tabs, Safari isolates specific domains (origins). If you visit a news website that contains an embedded ad from a different domain, Safari runs the news site in one WebContent process and the ad in a completely separate WebContent process.
• Memory Partitioning: Operating systems strictly forbid one unprivileged process from reading the memory of another. By putting different domains into different processes, Safari relies on the OS to guarantee that a malicious website in one tab—or an embedded iframe on the same page—cannot read the memory space of your email or banking tab.
• Network-Level Filtering: A compromised rendering process might try to request sensitive data from another domain. Safari prevents this by routing all internet traffic through a separate Network Process. The Network Process checks security policies (like Cross-Origin Resource Sharing) and blocks unauthorized cross-domain data before it is ever delivered to the isolated WebContent process.

The Combined Defense

By combining per-tab sandboxing and site isolation, Safari creates a two-layered containment system. Site isolation builds walls between different websites so they cannot spy on each other's data, while sandboxing builds a wall between those websites and your device's operating system. Even if a malicious site fully compromises the code running inside its own isolated space, it has nothing valuable to steal and nowhere to go.