Will a browser give an iframe a separate thread for JavaScript?
Recently tested if JavaScript running in a iFrame would block JavaScript from running in the parent window.
iFrame on same domain as parent:
- Chrome 68.0.3440.84: Blocks
- Safari 11.0.2 (13604.4.7.1.3): Blocks
- Firefox 61.0.1: Blocks
iFrame on different domain as parent
- Chrome 68.0.3440.84: Doesn't block
- Safari 11.0.2 (13604.4.7.1.3): Blocks
- Firefox 61.0.1: Blocks
parent.html:
<body> <div id="count"></div> <iframe src="./spin.html"></iframe> <script> let i = 0; let div = document.getElementById("count"); setInterval(() => { div.innerText = i++; }, 100); </script> </body>spin.html:
<body> <button id="spin">spin</button> <script> const spin = document.getElementById("spin"); spin.addEventListener('click', () => { const start = Date.now(); while (Date.now() - start < 1000) { } }) </script> </body>
Before chrome came along, all tabs of any browser shared the same single thread of JavaScript. Chrome upped the game here, and some others have since followed suit.
This is a browser implementation detail, so there is no solid answer. Older browsers definitely don't. I don't know of any browser that definitely uses another thread for iframes, but to be honest I've never really looked into it.
It isn't a security risk, as no objects are brought along with the thread execution.
To sum up the other answers: No, iFrames usually run in the same thread/process as the main page.
However, it appears the Chromium team are working on further isolation in this area:
Chromium Issue 99379: Out of process iframes [sorry, link not working - if you can find a link to the issue that works, please let me know]