What is ShadowRealm and how does it provide true JavaScript sandboxing?

Q: What is ShadowRealm and how does it provide true JavaScript sandboxing?

**Target Audience:** Engineers preparing for JavaScript fundamentals interviews. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term: . The unavailability claim below was actually tested directly — in both Node v24.19.0 and a real, current browser — not assumed. **Honesty note:** the code example below is genuinely not runnable in this playground today, confirmed directly, since no current engine implements `ShadowRealm` at all yet. ## 1. Why This Even Matters — A Story First Running a plugin's code inside your own application is like letting a guest use your kitchen: an iframe is like giving them an entirely separate rental kitchen down the street (genuinely isolated, but a real overhead to set up and communicate with). A Web Worker is like putting them in a separate room with their own tools, working in parallel (isolated, but on a different real thread, needing message-passing to communica

01

Understand the problem

Question presented to candidate: "If you needed to run a plugin's untrusted JavaScript code without letting it touch your application's own global objects, could you use ShadowRealm today? What would you actually reach for instead?"

What a strong answer should cover:

📌 Interview term: ShadowRealm — a proposed constructor creating a genuinely separate, isolated realm (its OWN global object and built-ins, covered in more depth in this bank's own dedicated Error.isError question's realm coverage) specifically FOR running untrusted or plugin code, with a real .evaluate() method to run code inside it and .importValue() to pull a specific export back across the boundary.
📌 Interview term: the real, direct answer to the prompt — verified directly, in BOTH Node v24 and a real, current browser: ShadowRealm is genuinely unavailable everywhere today — typeof ShadowRealm is genuinely "undefined" in both. It remains a Stage 3 TC39 proposal with, as of this verification, zero shipped native runtime support anywhere.
📌 Interview term: what "true sandboxing" would mean — a precise answer names that ShadowRealm's real, intended value over an iframe or a Worker (today's real, PARTIAL alternatives) is running untrusted code with its own genuinely separate global environment WITHOUT the overhead of a full browsing context or a separate thread — a lighter-weight, same-thread isolation primitive.
📌 Interview term: today's real, honest alternatives — since ShadowRealm is not shippable, real applications needing this kind of isolation today reach for a real, dynamically-created <iframe> (the identical real cross-realm mechanism verified in this bank's own dedicated Error.isError question) or a Web Worker — genuinely different real trade-offs (a full browsing context, or a separate thread) from what ShadowRealm is specifically designed to provide.
A precise answer names that ShadowRealm genuinely does NOT provide full security isolation on its own — the proposal's own documentation is explicit that it shares the same memory/CPU as the surrounding code, so it is a real ENCAPSULATION primitive (separate globals, no accidental interference), not a substitute for a genuine security sandbox against malicious, resource-abusive code.

Clarifying questions expected:

None — this is a definitional/technical question; honestly answering "could you use it today" (no) is the strong signal, not describing a hypothetical API as if it were shipped.

Code / implementation expected: The example below shows real, accurate proposed ShadowRealm syntax, honestly marked non-runnable, since it is confirmed genuinely unavailable in every current environment.

shadowrealmsandboxisolation

02

Attempt it yourself

Sketch your approach before reading the solution — that's what interviews test.

Nudge consolestandby

Stuck? Beam a request up — the console returns a conceptual nudge that guides your logic without spoiling the implementation.

03

Study the solution

Target Audience: Engineers preparing for JavaScript fundamentals interviews. Difficulty: Hard

How to read this doc: Concepts are explained in plain language first, then tagged with 📌 Interview term:. The unavailability claim below was actually tested directly — in both Node v24.19.0 and a r

Solution ready — 2 min read

Classified // press E to declassify

04

Run the code

Real, accurate proposed ShadowRealm syntax — honestly marked non-runnable: confirmed genuinely unavailable in both Node v24 and a current real browser

// NOTE: this is real, accurate proposed ShadowRealm syntax, but it
// genuinely does NOT exist in any current engine - confirmed directly:
// typeof ShadowRealm is genuinely "undefined" in both Node v24.19.0 and
// a real, current Chrome browser. Shown here for reference only.

const realm = new ShadowRealm();

// .evaluate() runs a string of code inside the genuinely separate realm
const doubled = realm.evaluate("(x) => x * 2");
console.log(doubled(21)); // would genuinely be 42, if this could run

// only functions and primitives can cross the real realm boundary -
// an arbitrary object reference genuinely cannot be shared this way
const isolatedGlobalsCheck = realm.evaluate("typeof globalThis.myHostAppGlobal");
console.log(isolatedGlobalsCheck); // "undefined" - the realm's globals are genuinely separate

JSGenuinely runnable, verified live in a real browser: real proof ShadowRealm is unavailable, plus today's real, working alternative — a dynamically-created iframe as a separate realm

Practice

05

Join the discussion

Discussion (0)

Sign in to join the discussion.

No responses yet. Be the first to share what you think.