Browsers & Standards Work 2026: Call for Community Input

Ecosystem and Usage
3

Project: Peergos

Use case: sandboxed (exfiltration proof, in its own OS process) serverless apps

Features we want in priority order are:

  1. webrtc CSP flag: Content Security Policy Level 3
  2. The ability to define a Service Worker on a unique origin from a local String (no server involvement at all) that is totally sandboxed from the parent context. This shouldn’t be content addressed, although we could work with that by varying the SW document.
  3. blake3 in webcrypto, ideally with an API for streaming, or even better, parallelising, a large file hash calculation chunk by chunk (think many GBs).

Our sandbox use case is described in more detail here:

and here:

We can, of course, help test any of the above. Our current approach for the sandbox requires assistance from the server (which can be localhost) which serves up the same static document which defines a service worker for all subdomains, isolated with COOP, COEP, and CSP. One problem here, apart from needing a server, is that sometimes the requests are not intercepted by the service worker. We would like to make that impossible.

4 Likes