Glossary · 4 · Platform SDKs and extensions
Sandboxing
Also known as: Sandbox, Software sandbox, Application sandbox
In computer security, sandboxing is the execution of code in a restricted, controlled environment that prevents it from accessing system resources, data or other software except those it is explicitly authorized to use, so that faulty or malicious code has limited effect outside the sandbox.
- Platform SDKs
- Security
In one sentence
Sandboxing runs code in a restricted environment that only reaches the resources it is authorized to use, limiting harm from faulty code.
Example
A browser loads a third-party widget in an iframe with the sandbox attribute; the widget can run scripts but cannot open pop-ups or navigate the page that embeds it.
How it applies
- Platform SDKs: Hosts that run third-party extensions often execute them in a sandbox: a separate process, a restricted script runtime, an iframe or a container. The SDK documents what the extension may call and which permissions it must request, usually in its manifest; everything else is blocked. This applies the principle of least privilege and is enforced alongside authorization checks.
- Browsers: Browsers isolate web content in sandboxed renderer processes, and HTML lets a page restrict embedded content with the
sandboxattribute of theiframeelement, which can be relaxed keyword by keyword (for exampleallow-scripts,allow-popups). - Hardware SDKs and devices: Mobile operating systems sandbox apps; Android, for example, assigns each app its own user ID and process and enforces the boundary in the kernel. Hardware SDKs describe which device functions an app may reach and through which permissions.
- Developer SDKs: Providers offer “sandbox” environments — test accounts or test instances with fake data — so that developers can try an API without touching production. This sense of the word means an isolated test environment, not an execution restriction; documentation should keep the two apart.
- Limits: A sandbox reduces the effects of a fault or attack; it does not remove them. Sandbox escapes are a known class of vulnerability, and the boundary has to be maintained and tested like any other security control.
Sandboxing vs. virtualization
A virtual machine emulates a whole computer and isolates a complete operating system; a container isolates processes that share the host kernel. Sandboxing is the broader goal of restricting what code can reach, and both techniques can implement it, as can language runtimes and operating-system mechanisms that restrict a single process.