Show HN: Firefox in WebAssembly

Show HN: Firefox in WebAssembly(developer.puter.com)

100 points by coolelectronics 2 hours ago | 49 comments

This is the entire Firefox browser rendering to a <canvas> element. Gecko, all UI components, and the Spidermonkey JS engine are all compiled and running in WebAssembly.

Here are a few things you might find interesting:

- This is fully end to end encrypted! We use the WISP protocol for TCP-over-websockets.

- There is a novel WASM->JS JIT for experimental site speedup

- This port cost over 25k in opus/fable tokens for debugging and JIT research

This was just a fun experiment to push the boundaries of WebAssembly. For a more usable "browser in browser" experience, we also built https://github.com/HeyPuter/browser.js that eats a bit less RAM.

yjftsjthsd-h 1 hour ago |

>This port cost over 25k in opus/fable tokens for debugging and JIT research

> This was just a fun experiment to push the boundaries of WebAssembly

I'm a huge fan of the project, but I have to ask. If spending $25k is a "fun experiment", where exactly is your threshold for serious work?

tiagod 56 minutes ago | |

Was it really $25k, or was it done though subscriptions with a reported cost of $25k?

I'm on the openai $100 sub and frequently my codexbar will show $250 usage in a day. I think it probably doesn't have access to the cached token share too, which probably inflates that a lot.

smalltorch 55 minutes ago | |

I imagine it is 25k tokens not dollars

andai 2 minutes ago | | |

I think the system prompt is bigger than that.

yjftsjthsd-h 39 minutes ago | | |

https://news.ycombinator.com/item?id=48927724 seems to say dollars? Although yes the phrasing could be clearer in the post

rustyhancock 52 minutes ago | | |

That's standard token usage for /init

dangoodmanUT 35 minutes ago | | |

25k tokens is a few turns

degamad 2 hours ago |

I'm so glad this exists, I've been considering doing something like this for a few months.

I recently got a TV based on VIDAA os, a locked-down linux-based OS where everything is rendered from Web pages. It has a built-in browser that doesn't support ad-blocking (I suspect VIDAA is profiting from showing ads on the TV), and you can't install new apps unless they're Web pages.

This would hopefully allow one to run Firefox within the existing browser, then install uBlock Origin within Firefox... I know what this weekend's project is going to be...

coolelectronics 1 hour ago | |

We also plan on adding extension support to https://github.com/HeyPuter/browser.js soon, which should hopefully cover use cases like that as well without the full overhead

shevy-java 1 hour ago | |

Firefox should really bundle ublock origin as-is. I install it afterwards anyway but I don't understand Mozilla here. They seem to want to stay behind Google.

quantummagic 1 hour ago | | |

In 2024, "search royalties" brought in approximately $585 million for Mozilla, largely from Google. It's not hard to see why they tread very lightly around ad blocking. It's actually impressive that ublock remains easy and painless to install as an extension.

elmer2 10 minutes ago |

I would be careful with this demo. When you go to whatismyip.com, it's showing: 104.28.233.73. Someone could use this to cloak their IP address and do some damage.

koolala 10 minutes ago |

What makes it require that WASM extension you need the flag for in Firefox? Was there really no way to work around it or polyfill it for it to work? It is performance critical?

coolelectronics 36 seconds ago | |

It is required in order to yield the event loop and force an implicit sync on OffscreenCanvas. There is technically a slower workaround for this but JSPI is coming soon anyway to firefox 153 and safari 27.

coolelectronics 2 hours ago |

Oh and for anyone asking, you can run firefox-wasm inside firefox-wasm inside firefox! I only got this to load once though since it gets pretty unstable at that level.

brewmarche 1 hour ago |

Can’t get it running on Firefox 152.0.6 (aarch64), no extensions.

  [chrome-demo] chrome assets ready
  [gecko] warning: unsupported syscall: __syscall_madvise
  [gecko] embed-xul: main() on the app pthread (PROXY_TO_PTHREAD)
  [gecko] embed-xul: GECKO_GL_PASSTHROUGH=1
  [gecko] embed-xul: GECKO_COARSE_CLOCK=1
  [gecko] embed-xul: GECKO_GPU=1 (GPU/WebRender->canvas rendering)
  [gecko] xul_init: GRE dir = /gre
  [gecko] Pthread 0x11051000 sent an error! blob:https://developer.puter.com/edc1bd0a-b844-4a18-a69a-63dd49dc304a:8906: SecurityError: Security error when calling GetDirectory

rlmineing_dead 52 minutes ago | |

Running firefox on aarch64 here right now (Ubuntu 26.04 ARM on snapdragon X1E)

did you enable the about:config option? it may be required

brewmarche 51 minutes ago | | |

Yes, you don’t get that far without it.

MajesticHobo2 1 hour ago |

Browser sandboxing is now fully solved.

yjftsjthsd-h 1 hour ago | |

In mean... It kinda feels like this is legitimately true? An attacker trying to do anything on a user's machine through this would have to find a Firefox vulnerability and a vulnerability in the wasm runtime, which is such a high bar that I would actually feel remarkably safe running this thing. The only question is how performance works and whether there are any pain points using as a daily driver, but those feel likely to be a pretty minor point. Oh, and the usual caveat that an attacker can still compromise things inside the sandbox which does leave a certain amount of exposure (but if you run different things in different instances they're isolated).

rlmineing_dead 48 minutes ago | | |

This is true but also this is probably also only half true. Sandboxing is not a fully solved issue since this 100% degrades firefox sandboxing since fission cant run and its running in singleprocess mode. Just wanted to be honest about this

azakai 1 hour ago |

Prior art: WebKit.js, the WebKit rendering engine ported to JS

https://github.com/trevorlinton/webkit.js/

zerof1l 1 hour ago |

All the network traffic from that browser is routed through a server. My IP inside that browser was in India and on CloudFlare network. I don’t particularly trust Puter. Why not route traffic through my actual browser?

simonw 58 minutes ago |

This is amazing. I loaded up https://developer.puter.com/labs/firefox-wasm/ in Chrome and I've visited a bunch of sites, it works really well.

Then I opened up https://developer.puter.com/labs/firefox-wasm/ in Firefox-in-WebAssembly-in-Chrome

... and sadly it didn't load. I got this in the startup log:

  [log] [chrome-demo] chrome assets ready
  [warn] [gecko] warning: unsupported syscall: __syscall_madvise

SpyCoder77 20 minutes ago |

No mobile support

sangeeth96 1 hour ago |

edit: I misunderstood, that's $25k not 25k tokens :/ time to log off.

this is so rad! 25k tokens is a lot less than i thought this'd take -- what were the difficult bits in the porting process? also, was firefox preferred because parts of it are already in rust?

coolelectronics 1 hour ago | |

$25k of tokens, closer to 30 billion I believe. It only took a few days to actually get the engine up, the hard parts where most of the effort was spent was squeezing out performance and increasing stability, as well as attempting the JIT.

Firefox was chosen because its single-process support was in a better place than chromium/blink. WebKit is also possible, it was done by a friend of mine earlier https://github.com/theogbob/WebkitWasm

sangeeth96 1 hour ago | | |

ah, i misunderstood. that seemed way too low in terms of actual tokens lol. i'll log off now. interesting details and didn't know about WebkitWasm. hope to read more soon.

eqrion 2 hours ago |

> There is a novel WASM->JS JIT for experimental site speedup

I would love to see the details for this. SpiderMonkey had an attempted wasm32 JIT backend, but it was never finished.

edit: Apparently it also has some sort of WebAssembly interpreter backend too, which SpiderMonkey doesn't have.

throwaway2027 2 hours ago |

Obligatory https://www.destroyallsoftware.com/talks/the-birth-and-death...

rlmineing_dead 2 hours ago | |

I had this in mind when I first saw this project too LOL

Every year I need to rewatch this talk

mdlxxv 2 hours ago |

"Yo dawg. I herd you like web browsers, so I put a browser in your browser, so you can browse the Web while you browse the Web".

ent101 2 hours ago | |

should've used this in the splash screen :(

som 2 hours ago |

... doesn't support Firefox mobile apparently :D

rlmineing_dead 2 hours ago | |

Does firefox mobile (Android, since firefox mobile iOS is a WebKit wrapper) support about:config settings? if so you can enable wasm_js_promise_integration in about:config and have it working likely. I will test this on my Pixel 10 pro

rlmineing_dead 1 hour ago | | |

hi reporting back, yes stock firefox mobile wont work but the BETA version will because it just added the WASM feature needed (firefox 153 adds it but regular mobile firefox lacks about:config support it seems)

and by "will work" I mean will render the first frame and then freeze

YMMV

jedisct1 1 hour ago |

"This browser doesn't support WebAssembly JSPI, which Firefox WASM needs to run."

rlmineing_dead 46 minutes ago | |

safari? I think its going to be added in 27

[chrome-demo] chrome assets ready [gecko] warning: unsupported syscall: __syscall_madvise [gecko] embed-xul: main() on the app pthread (PROXY_TO_PTHREAD) [gecko] embed-xul: GECKO_GL_PASSTHROUGH=1 [gecko] embed-xul: GECKO_COARSE_CLOCK=1 [gecko] embed-xul: GECKO_GPU=1 (GPU/WebRender->canvas rendering) [gecko] xul_init: GRE dir = /gre [gecko] Pthread 0x11051000 sent an error! blob:https://developer.puter.com/edc1bd0a-b844-4a18-a69a-63dd49dc304a:8906: SecurityError: Security error when calling GetDirectory