# V8 JIT JavaScript/Wasm engine can be disabled & configured on a per-site basis in Chromium 122 **URL:** https://discuss.privacyguides.net/t/v8-jit-javascript-wasm-engine-can-be-disabled-configured-on-a-per-site-basis-in-chromium-122/17126 **Category:** General **Created:** 2024-02-28T15:30:49Z **Posts:** 15 ## Post 1 by @jonah — 2024-02-28T15:30:49Z Nobody seems to have noticed this here yet, but Chromium now has native support for configuring the V8 optimizer at `chrome://settings/content/v8` This effectively brings Microsoft Edge’s [Super Duper Secure Mode](https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/) to all Chromium browsers, including the latest release of Brave: ![bTn8cNH3NI8pGKxN](//forum-uploads.privacyguidesusercontent.com/original/2X/8/820565abd15ec557db5ee62dafffdcc28f3bd8b2.png) For some reason the only announcement I could find about this feature was in the Chrome Enterprise/Education [changelog](https://support.google.com/chrome/a/answer/7679408?sjid=10860107020893204889-NC#chromeBrsrG122). --- ## Post 2 by @redoomed1 — 2024-02-28T15:45:00Z Note that for Brave at least, per-site exceptions do not work unless you enable an “experimental” flag. > > > ## Description > > > When V8 optimiser is disabled globally, but a site is allow…ed as an exception to this, WebAssembly is broken, when it should not be. > > ## Steps to Reproduce > > > 1. Navigate to https://wasm-feature-detect.surma.technology/ > 2. Observe WebAssembly features are detected and work fine > 3. Disable V8 optimiser by default in brave://settings/content/v8 > 4. Whitelist https://wasm-feature-detect.surma.technology/ (or another website which uses V8( > 5. Navigate to https://wasm-feature-detect.surma.technology/ in a fresh tab > 6. Observe WebAssembly features are now undetected due to it being broken > > ## Actual result: > > WebAssembly is broken on a whitelisted site allowed to use the V8 optimiser > > ## Expected result: > WebAssembly works on sites where V8 optimiser has been allowed when V8 optimiser has been disallowed globally by default. > > ## Reproduces how often: > > 100% > > ## Desktop Brave version: > > Brave | 1.63.157 Chromium: 122.0.6261.43 (Official Build) (64-bit) > Revision | 5fbb7c60cc44e15a910a39a349e632f1b904c58e > OS | Windows 11 Version 22H2 (Build 22621.3155) > > ## Version/Channel Information: > > > - Can you reproduce this issue with the current release? Yes, (as above) > - Can you reproduce this issue with the beta channel? Yes > > Brave | 1.64.74 Chromium: 122.0.6261.43 (Official Build) beta (64-bit) > Revision | b03db955df4f1c679cb7c2ae8ebfd331d5c29276 > OS | Windows 11 Version 22H2 (Build 22621.3155) > > - Can you reproduce this issue with the nightly channel? Yes > > Brave | 1.65.6 Chromium: 122.0.6261.43 (Official Build) nightly (64-bit) > Revision | 9434ed9324c9af88c51324c06e23730447030643 > OS | Windows 11 Version 22H2 (Build 22621.3155) > > ## Other Additional Information: > > - Does the issue resolve itself when disabling Brave Shields? No > - Does the issue resolve itself when disabling Brave Rewards? No > - Is the issue reproducible on the latest version of Chrome? Yes, 122.0.6261.39 > > ## Miscellaneous Information: * * * On a separate note, after a week of using this setting, the few sites in which I’ve observed breakages due to disabling V8 were ~~Element (logging in via the official site and in-house/homeserver-provided clients)~~ and FluffyChat. Edit: huh, after the most recent update to Chromium 122.0.6261.94 on Brave, it seems that Element works across the board (albeit with noticable slowness) even without setting a site exception (Strict Origin Isolation enabled, V8 disabled). So something under the hood must have been changed in the Chromium bump, which aligns with what @jonah tested in post 5 of this thread. --- ## Post 3 by @jonah — 2024-02-28T15:53:30Z Interesting, can confirm that is the case in multiple Chromium browsers, and the suggested `chrome://flags/#strict-origin-isolation` flag fixes it. Worth noting that the bug only affects WebAssembly, but also I suspect Wasm is probably the main reason you’d want to add a per-site exception in the first place, so it’s a bit of a big deal. Seems like enabling this flag _might_ pose resource consumption issues: [https://issues.chromium.org/issues/40601197](https://issues.chromium.org/issues/40601197) (but as the issue above notes, other projects have enabled the flag without issue, so…) This explains why I was having trouble using per-site exceptions a few months ago when I was trying to do this with the [JavaScriptJitAllowedForSites](https://chromeenterprise.google/policies/#JavaScriptJitAllowedForSites) enterprise policy lol --- ## Post 4 by @anon21666177 — 2024-02-29T02:28:26Z With this, does it mean Brave offers the same level of protection as Safari with lockdown mode enabled? I’m just wondering if I should change my default browser on desktop. --- ## Post 5 by @jonah — 2024-02-29T04:03:15Z I’m confused, it seems like they’ve changed this behavior now between Chromium 122.0.6261.57 and 122.0.6261.94. On the latest version if I go to test whether WebAssembly is enabled on a site like [https://wasm-feature-detect.surma.technology/](https://wasm-feature-detect.surma.technology/) it shows that it _is_ enabled despite “Don’t allow sites to use the V8 optimizer” being set. I guess this is intentional, so changing this setting isn’t truly, completely JITless as the enterprise policy name would suggest: > **[Chromium](https://issues.chromium.org/issues/325992828)** > As of r1247811, there is a new site setting, which is entitled “Sites > can use the V8 optimizer”. The actual behavior of that setting, though, > is that it disables _all_ use of JIT in the renderer, which means > disabling WebAssembly support altogether. > > Since M122 is going to stable imminently, this change is the minimal fix > to avoid breaking an existing web API (wasm): the site setting’s > behavior is changed to match what the settings page describes. Since > this setting is _also_ tied to enterprise policies: > > - DefaultJavaScriptJitSetting > - JavaScriptJitAllowedForSites > - JavaScriptJitBlockedForSites > > This change will cause a behavior change for users of those policies: > webassembly will be enabled for sites for which it would previously have > been disabled. I don’t understand why this (highlighted) was considered a bug. Edit: In [https://issues.chromium.org/issues/325974501](https://issues.chromium.org/issues/325974501) they indicate this might be fixed in 123. --- ## Post 6 by @anon80779245 — 2024-02-29T05:51:33Z What are the actual privacy or security benefits of doing so ? --- ## Post 7 by @FlipSid — 2024-02-29T06:10:37Z Has anyone found it on Brave Android ? @anon80779245 : Disabled JIT = Attack surface reduction > **[Edge Super Duper Secure Mode turns off the JavaScript JIT compiler for extra...](https://www.zdnet.com/article/edge-super-duper-secure-mode-turns-off-the-javascript-jit-compiler-for-extra-security/)** > > Microsoft experiments with disabling the JIT JavaScript compiler in an effort to provide better security. --- ## Post 8 by @sha123 — 2024-02-29T13:26:51Z > [@FlipSid](#): > > Has anyone found it on Brave Android ? It’s not there yet. Not even in nightly. --- ## Post 9 by @sha123 — 2024-02-29T13:32:10Z > [@jonah](#): > > This effectively brings Microsoft Edge’s [Super Duper Secure Mode](https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/) to all Chromium browsers, including the latest release of Brave: Disabling JIT on Chromium Browsers on desktop has been available for a long time either via flags or enterprise/group policy, the latter also with site exceptions. This has also enabled additional exploit mitigations. Unfortunately it’s still not the same as on Edge from a usability perspective, since Drumbrake is missing. > [@jonah](#): > > chrome://flags/#strict-origin-isolation Good point. Have used this flag for quite some time and experienced no negative downsides yet. --- ## Post 10 by @sha123 — 2024-02-29T13:33:51Z > [@anon21666177](#): > > With this, does it mean Brave offers the same level of protection as Safari with lockdown mode enabled? Even more protection, since Chromium is still stronger in some security areas. --- ## Post 11 by @jonah — 2024-02-29T16:48:35Z Would anyone mind launching the latest Google Chrome with `--js-flags="--jitless"` and letting me know whether [Wasm Test](https://arw.me/testing/misc/wasmdetect.html) says wasm is supported in your browser? --- ## Post 12 by @Riliuye — 2024-02-29T16:57:59Z Installed the latest Google Chrome from Flathub It gave me: - Start - typeof WebAssembly === “object”: false - Error caught: ReferenceError: WebAssembly is not defined - WebAssembly appears to NOT be supported :pleading_face: - Done --- ## Post 13 by @jonah — 2024-02-29T16:58:33Z Which version is that in `chrome://version`? --- ## Post 14 by @Riliuye — 2024-02-29T16:59:04Z 122.0.6261.94 --- ## Post 15 by @jonah — 2024-02-29T17:09:22Z Really strange. I dug out my Linux laptop and I do get that response as well, but I don’t see that on macOS or Windows :thinking: If anyone not on Linux could try it that would be handy :slight_smile: