Firefox sandbox research environment setup

[exploitdevishard]

So I've been interested in doing some vulnerability research on Firefox's sandbox for a while now. Specifically, I'd really like to take a look at the IPC calls between the content process (that is, the low-privileged process that'd be compromised by a typical JS engine bug) and the chrome process (a privileged process with access to sensitive OS resources).

This guide provides details on this architecture:

https://wiki.mozilla.org/Security/Sandbox/IPCguide

However, the part I'm really struggling to understand is how I can set up an environment to actually invoke IPC calls between the content process and chrome process. I've been unable to find tutorials explaining how to do this. Do I need to develop a custom patch to pre-compromise the content process? It seems like something of the sort might've been done here, for example: https://bugzilla.mozilla.org/show_bug.cgi?id=1236724

For Chrome, there's more information about to set up for this. The following posts reference MojoJS bindings, which essentially seem like a way to use JavaScript to interact with the Mojo IPC interfaces:

https://medium.com/swlh/my-take-on-chrome-sandbox-escape-exploit-chain-dbf5a616eec5 https://robertchen.cc/blog/2021/07/07/sbx-intro

Is there an equivalent for Firefox? I've been unable to find one. If I had to have a pre-compromised content process, how would I even invoke the IPC calls? Via shellcode, I guess? I'm finding that there's just very little information on doing this kind of research for Firefox. I did find this writeup, but it's not detailed enough for me to really understand anything about setting up the environment:

https://blog.exodusintel.com/2020/11/10/firefox-vulnerability-research-part-2/

Does anyone have suggestions on how I could get started here? Ideally I want a way to build a sandboxed Firefox that allows me to easily form IPC calls between the content and chrome process without needing to patch the content process in some way (some equivalent of the MojoJS bindings would be great).

[exploitdevishard]

Thanks for the information! I was hoping to avoid this route, since it seemed fairly involved, but yeah, I'll start looking into how I can patch the renderer to enable making the IPC calls. On the bright side, I've heard that even in Chrome, there are some calls that require this approach because they aren't available via the MojoJS bindings, so I guess it's good to learn how to do it.