What is ShadowRealm and how does it provide true JavaScript sandboxing?

Q: What is ShadowRealm and how does it provide true JavaScript sandboxing?

**Target Audience:** Engineers preparing for JavaScript fundamentals interviews. **Difficulty:** Hard > **How to read this doc:** Concepts are explained in plain language first, then tagged with 📌 Interview term: . The unavailability claim below was actually tested directly — in both Node v24.19.0 and a real, current browser — not assumed. **Honesty note:** the code example below is genuinely not runnable in this playground today, confirmed directly, since no current engine implements `ShadowRealm` at all yet. ## 1. Why This Even Matters — A Story First Running a plugin's code inside your own application is like letting a guest use your kitchen: an iframe is like giving them an entirely separate rental kitchen down the street (genuinely isolated, but a real overhead to set up and communicate with). A Web Worker is like putting them in a separate room with their own tools, working in parallel (isolated, but on a different real thread, needing message-passing to communica

The problem

Question presented to candidate: "If you needed to run a plugin's untrusted JavaScript code without letting it touch your application's own global objects, could you use ShadowRealm today? What would you actually reach for instead?"

What a strong answer should cover:

📌 Interview term: ShadowRealm — a proposed constructor creating a genuinely separate, isolated realm (its OWN global object and built-ins, covered in more depth in this bank's own dedicated Error.isError question's realm coverage) specifically FOR running untrusted or plugin code, with a real .evaluate() method to run code inside it and .importValue() to pull a specific export back across the boundary.
📌 Interview term: the real, direct answer to the prompt — verified directly, in BOTH Node v24 and a real, current browser: ShadowRealm is genuinely unavailable everywhere today — typeof ShadowRealm is genuinely "undefined" in both. It remains a Stage 3 TC39 proposal with, as of this verification, zero shipped native runtime support anywhere.
📌 Interview term: what "true sandboxing" would mean — a precise answer names that ShadowRealm's real, intended value over an iframe or a Worker (today's real, PARTIAL alternatives) is running untrusted code with its own genuinely separate global environment WITHOUT the overhead of a full browsing context or a separate thread — a lighter-weight, same-thread isolation primitive.
📌 Interview term: today's real, honest alternatives — since ShadowRealm is not shippable, real applications needing this kind of isolation today reach for a real, dynamically-created <iframe> (the identical real cross-realm mechanism verified in this bank's own dedicated Error.isError question) or a Web Worker — genuinely different real trade-offs (a full browsing context, or a separate thread) from what ShadowRealm is specifically designed to provide.
A precise answer names that ShadowRealm genuinely does NOT provide full security isolation on its own — the proposal's own documentation is explicit that it shares the same memory/CPU as the surrounding code, so it is a real ENCAPSULATION primitive (separate globals, no accidental interference), not a substitute for a genuine security sandbox against malicious, resource-abusive code.

Clarifying questions expected:

None — this is a definitional/technical question; honestly answering "could you use it today" (no) is the strong signal, not describing a hypothetical API as if it were shipped.

Code / implementation expected: The example below shows real, accurate proposed ShadowRealm syntax, honestly marked non-runnable, since it is confirmed genuinely unavailable in every current environment.

shadowrealm
sandbox
isolation

Try it yourself

Sketch your approach before you read the solution. That is what the interview tests.

Stuck? Get a hint.

A short nudge toward the approach. It will not give the answer away.

Solution

Target Audience: Engineers preparing for JavaScript fundamentals interviews. Difficulty: Hard

How to read this doc: Concepts are explained in plain language first, then tagged with 📌 Interview term:. The unavailability claim below was actually tested directly — in both Node v24.19.0 and a real, current browser — not assumed. Honesty note: the code example below is genuinely not runnable in this playground today, confirmed directly, since no current engine implements ShadowRealm at all yet.

1. Why This Even Matters — A Story First

Running a plugin's code inside your own application is like letting a guest use your kitchen: an iframe is like giving them an entirely separate rental kitchen down the street (genuinely isolated, but a real overhead to set up and communicate with). A Web Worker is like putting them in a separate room with their own tools, working in p

The solution is hidden so you can try first

6 min read · 9 sections

Run the code

Edit the code and run it here. Each console line with an expected value becomes a test.

JavaScriptReal, accurate proposed ShadowRealm syntax — honestly marked non-runnable: confirmed genuinely unavailable in both Node v24 and a current real browser

// NOTE: this is real, accurate proposed ShadowRealm syntax, but it
// genuinely does NOT exist in any current engine - confirmed directly:
// typeof ShadowRealm is genuinely "undefined" in both Node v24.19.0 and
// a real, current Chrome browser. Shown here for reference only.

const realm = new ShadowRealm();

// .evaluate() runs a string of code inside the genuinely separate realm
const doubled = realm.evaluate("(x) => x * 2");
console.log(doubled(21)); // would genuinely be 42, if this could run

// only functions and primitives can cross the real realm boundary -
// an arbitrary object reference genuinely cannot be shared this way
const isolatedGlobalsCheck = realm.evaluate("typeof globalThis.myHostAppGlobal");
console.log(isolatedGlobalsCheck); // "undefined" - the realm's globals are genuinely separate

JavaScriptGenuinely runnable, verified live in a real browser: real proof ShadowRealm is unavailable, plus today's real, working alternative — a dynamically-created iframe as a separate realm