> The Chromium sandbox on Windows has stood the test of time. It’s considered one of the better sandboxing mechanisms deployed at scale without requiring elevat

> The Chromium sandbox on Windows has stood the test of time. It’s considered one of the better sandboxing mechanisms deployed at scale without requiring elevated privileges to function. For anyone who is interested in the history, this type of Restricted Token & Job Object sandbox was, as far as I know, first used in MOICE (Microsoft Office Isolated Conversion Environment). This was created by Microsoft's Office Trustworthy Computing group to isolate the conversion of `.doc` to `.docx`. David LeBlanc blogged about it in 2007, with his "Practical Windows Sandboxing" series[0][1][2]. Of course a third party may have independently discovered the same techniques but kept it to themselves. The state of the art has improved since then but the general principles are the same. [0]: https://docs.microsoft.com/en-us/archive/blogs/david_leblanc/practical-windows-sandboxing-part-1 https://docs.microsoft.com/en-us/archive/blogs/david_leblanc... [1]: https://docs.microsoft.com/en-us/archive/blogs/david_leblanc/practical-windows-sandboxing-part-2 https://docs.microsoft.com/en-us/archive/blogs/david_leblanc... [2]: https://docs.microsoft.com/en-us/archive/blogs/david_leblanc/practical-windows-sandboxing-part-3 https://docs.microsoft.com/en-us/archive/blogs/david_leblanc...