Aephoron

Appearance

Security & Sandbox ​

Kinetoor inherits Servo's process-isolation design and extends it with Empoorio-specific hardening. Today Kinetoor runs single-process (v0.4) — full multi-process isolation (separate OS processes per subsystem, sandboxed renderers) is real, tracked roadmap work (v0.8), not yet shipped.

Process isolation ​

  • Single-process today — script, layout, network, and paint run as subsystems within one process
  • Renderer process sandboxing at the OS level is planned for the multi-process milestone (v0.8)
  • IPC scaffolding via ipc-channel — typed messages, no shared mutable heap
  • Constellation enforces per-origin permissions and navigation policies

Content security ​

  • CSP (Content Security Policy) enforcement in the script pipeline
  • SRI (Subresource Integrity) for external scripts and styles
  • Mixed-content blocking — HTTPS upgrade for passive content
  • Certificate chain validation with user-visible TLS errors

Post-quantum TLS ​

The network stack uses Rustls with aws-lc-rs:

  • ML-KEM key exchange
  • ML-DSA signatures
  • Available when peers negotiate PQ cipher suites

Aephoron is among the first browsers targeting PQ-TLS natively in the transport layer.

Memory safety ​

Rust eliminates use-after-free and buffer overflows in engine code paths. SpiderMonkey remains in C++; isolating it in a dedicated process with a restricted IPC surface is part of the multi-process roadmap work.

Web3 key isolation ​

Wallet private keys never enter the JavaScript heap. Signing requests cross a secure IPC bridge to Eoonia's OS enclave storage.

Shields (Aephoron layer) ​

User-facing privacy controls built on Kinetoor's network and script hooks:

  • Tracker and ad blocking
  • Fingerprint resistance
  • Per-site shield toggles
  • On-device Ailoos — no cloud exfiltration of page content for AI features