Microsoft will herald a security project called Web Sandbox, for securing Web content through isolation, at the company's Professional Developers Conference in Los Angeles this week.
The Microsoft Live Labs Web Sandbox features a prototype of technology for mashing up code while maintaining better process isolation, quality of service protection, and security, according to the company.
"This will foster more efficient cross-browser development, increased mash-up innovation, and new third-party extensibility models," according to a description of the PDC effort released by a Microsoft representative.
The Live Web Sandbox Web site describes the project as addressing the problem of modern Web applications being "intrinsically insecure, often with unpredictable service quality."
"Today, Web gadgets, mashup components, advertisements and other third-party content on Web sites either run with full trust alongside your content or are isolated inside of IFrames," resulting in a lack of security, the Web page states.
A growing number of Web 2.0 applications incorporate third-party content either via direct script inclusion or embedded in an IFrame, Live Labs said. Components included directly execute with full trust and can access private information, according to Live Labs. This leaves a site subject to intentional or non-intentional bugs that could compromise personal information or degrade a Web application's quality of service.
IFrames, meanwhile, offer isolation but not complete security, Live Labs said. Malicious code can try to install ActiveX controls, redirect users, or interrogate a browser history, thus degrading quality of service. IFrames also pose a problem with providing an integrated experience and sharing data across components, the labs said.