What Is a Sandbox?
A sandbox is an isolated environment where untrusted code can run without being able to harm the host system. The idea is containment: give the code a sealed room with limited exits, so that even if it turns out to be malicious, the blast radius is the sandbox, not your machine. It is one of the most widely deployed security patterns in modern computing.
Where are sandboxes used?#
You rely on sandboxes constantly, often without noticing:
- Browsers run each site’s code in a sandbox so a malicious page cannot read your files — reinforcing the same-origin policy.
- Mobile apps run in per-app sandboxes that isolate their data from each other.
- Malware analysis detonates suspicious files in a disposable sandbox to observe behavior safely.
- Serverless and containers use isolation to keep tenants apart.
Each case applies the same principle: run the risky thing somewhere its failure is survivable — defense in depth through isolation.
What are the limits of sandboxing?#
Sandboxes are strong but not magic:
| Limit | What it means |
|---|---|
| Sandbox escapes | A bug in the boundary lets code break out |
| Evasion | Malware detects the sandbox and hides |
| Resource cost | Isolation adds overhead |
Sandboxing is isolation applied to untrusted code. It underpins container and browser security alike — see the Defense & Hardening hub and the Security Fundamentals hub.
Frequently asked questions#
What is a sandbox in computer security?
A sandbox is an isolated environment that runs untrusted code with restricted access to the rest of the system. If the code is malicious, the damage is contained within the sandbox rather than reaching the host. Browsers, mobile apps, and malware analysis tools all rely on sandboxing to limit what untrusted code can touch.
Can malware escape a sandbox?
Sometimes. A "sandbox escape" exploits a flaw in the isolation boundary to break out into the host. Advanced malware also detects when it is being analyzed in a sandbox and stays dormant to avoid revealing itself. Sandboxes are a strong layer of defense, but like any control they are not absolute.