Microsoft Edge Tests Disabling JavaScript JIT Compiler to Boost Security
Microsoft has been running experiments and performance testing with special builds of their Edge browser, where the JavaScript just-in-time compiler is disabled. The goal of the experiment is to see how much of a beneficial effect this can have on security.
A JIT or just in time interpreter is a module in which JavaScript is processed and compiled dynamically, as the code is accessed by the browser. While languages such as C++ and C# are first processed by a compiler before execution is possible, a just-in-time interpreter processes and optimizes the JavaScript as it is read in real-time, as the name suggests.
Microsoft published a piece named "Super Duper Secure Mode", focusing on the experiment with disabling the JIT compiler in Edge. The highlight of this change is that with the JIT compiler turned off, the browser was able to make use of several protection technologies that were not compatible with the JIT.
Those include Intel's Control-Flow Enforcement Technology (CET), as well as Microsoft's Arbitrary Code Guard - an additional mitigation measure that exists in Windows.
The Microsoft article, put together by Jonathan Normal who heads MS Edge vulnerability research, calls the fact that these technologies are incompatible with JIT "unfortunate", as the interpreter works with "untrusted content", which should be as limited in permissions and as "locked down" as possible.
ZDNet reports that while the testing done by Microsoft claims users barely notice any sort of observable slowdown while the JIT is disabled, external benchmark tests recorded a significant reduction in performance.
Page loading times were also affected, with Microsoft reporting a regression of "around 17%", while browser startup times have improved slightly with the JIT disabled.
Users who want to test the Super Duper Secure mode on their own will need to get a beta release of the Edge browser and turn the mode on in the edge://flags settings page.
At present, WebAssembly is not compatible with the Super Duper Secure mode and only Intel's CET is turned on, but that is of course subject to change, as the mode is further developed and fine-tuned.
