3 ms·

I know V8 from back to front and I feel that it is quite safe, after all, there's not much you can do with a javascript interpreter ... Regarding the CVEs ment

I know V8 from back to front and I feel that it is quite safe, after all, there's not much you can do with a javascript interpreter ... Regarding the CVEs mentioned, the overwhelming majority of them have a "denial of service" effect, not sure how something like gVisor helps you mitigate that.

helloooooooo 4y ago
If you know it back to front, then you are likely aware of the number of TurboFan vulnerabilities that have been found being exploited in the wild.
- moralestapia 4y ago
  Sure, and most of them have been addressed properly. Honestly (as another commenter said), V8 being behind one of Google's largest revenue streams makes it feel "safe enough" for me, they have all the resources and incentive to make it as safe as realistically possible. Of course it's not perfect, but is there anything better at the moment?
  - mkl 4y ago
    With all their resources and incentive, Google have chosen to rely on process isolation in Chrome, not just V8.
    - moralestapia 4y ago
      Process isolation (security) belongs to the OS so there's nothing stopping one from doing the same, also, it shouldn't be much difficult to implement.