Sandbox Level in various browsers and operating systems

Would it be possible to post a screen to compare with the sandbox of various browsers?
Thanks in advance.

Edge in W.10 x64:

 

Edge Version 101.0.1210.53 (Official build) (64-bit)

 

@wat0114

Thank you for the availability.
You can see that the Renderer does not have Integrity Level AppContainer.
Network Service + Audio Service are not protected by internal sandbox.

Any other forum members want to post an image for comparison?

 

Thanks @Sampei Nihira

fwiw, these are my Edge registry keys:



I see several Edge renderers with IL AppContainer using PE.



Is there something I'm missing?

 

If you've made adjustments you should see the results in

Edge://sandbox

You miss:

NetworkServiceSandboxEnabled to 1

 

Okay now enabled, so I have this:



Thanks!

 

Audio Service is not listed in sandbox.

 

Strange, it is now, and I didn't change anything except to reboot pc.

 

You have greatly increased the security of your Edge.

 

Thanks again

 

Uhm, any takers for the pretty browser over there in red and green?...

 

sandbox level is tied to system "integrity", firefox is using "low", chrome is using "anonymous". there exist 5 levels.
https://docs.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control

"anonymous" is below "low", check with Process Hacker or Process Explorer.

thats reason why firefox had issues in sandboxie with its default sandbox levels - no access.

 

How do we enable Network Service to be sandboxed with Edge?

 

see #5 ?

 

Yes sir got it. Was not sure of the registry key but just looked that up. Mine is enabled now.

 

Brave on Windows 10:

As you can see, compared to Edge, Audio Service is sandboxed by default.

Firefox does not really seem to have a page like this.

 

Chromium chrome://sandbox on Fedora 35:

Firefox about:support on Fedora 35:


EDIT: Firefox about:support on Windows is nothing special to see, compared to Linux, only the bottom 3 items exist. The first 2 are level 6 and 3rd one says Win32k lockdown enabled - default setting.

 

Are you guys testing on admin or SUA?

When testing on admin, Edge showed the appcontainer info. But on SUA, it didn’t.

 

How exactly is this protecting us with the NetworkService set to be sandboxed?

EDIT: @Azure Phoenix I am testing as admin, not SUA.

 

Same on Kubuntu 20.04 (about:support)

 

The registry keys have local validity,you have to edit them locally not in the administrator account if you use the Standard account instead.

 

Not only sandboxed but it is also at the AppContainer level.
The best protection is obvious.

 

Is there a flag for this as well? I have my registry similar to your but AudioService is not listed.



Strange enough, AudioService now appears for me in sandbox settings.

 

@Trooper

these are my Edge registry values:

Code:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Edge]
"RendererAppContainerEnabled"=dword:00000001
"DefaultFileSystemReadGuardSetting"=dword:00000002
"DefaultFileSystemWriteGuardSetting"=dword:00000002
"AudioSandboxEnabled"=dword:00000001
"DnsOverHttpsMode"="automatic"
"DnsOverHttpsTemplates"="https://dns.quad9.net/dns-query"
"NetworkServiceSandboxEnabled"=dword:00000001

I first renamed Edge.reg to Edge.txt, then copy & pasted contents here. I use Quad9 DNS, thus the user-specific string for it.

EDIT

Process Explorer can be used to check Type and Integrity levels of the individual Edge renderers or utility processes.