SoK: Taxonomizing the Low-Level Attack Surface of Modern Web Browsers
2026-06-15 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied how web browsers, which are common targets for hackers, can be attacked through memory bugs. They created a new system to organize browser parts and inputs to better understand where these bugs happen. They looked at over 2,200 memory bug reports and compared them to where security tests (called fuzzers) have been focused over the past decade. They found that many risky areas in browsers are not tested enough. This work helps guide future efforts to improve browser security testing.
web browser securitymemory corruptionattack surfacefuzz testingsoftware vulnerabilitiesbug taxonomybrowser architecturesecurity testing gaps
Authors
Han Zheng, Qinying Wang, Qiang Liu, Mathias Payer
Abstract
The web browser remains one of the most exposed remote attack surfaces on end-user systems, and memory-corruption flaws continue to play a central role in real-world browser exploitation. Despite a decade of intensive browser testing and bug-disclosure efforts, the community still lacks an explicit, defense-oriented systematization of the browser's low-level attack surface. Prior SoKs have surveyed browser vulnerabilities and mitigation techniques. However, these perspectives remain fragmented, leaving open a central question: how is the low-level attack surface of modern web browsers structured, and which parts of this surface remain underexplored by existing security testing? We approach this primary question through three sub-questions. (RQ1) How is the browser's attack surface structured along input classes and components? (RQ2) Where do memory corruption vulnerabilities arise within this taxonomy? (RQ3) What do these attack-surface patterns imply for existing browser security testing? To answer RQ1, we derive an architecture-grounded Input x Component x Privilege taxonomy that abstracts the architectures of browsers into a unified view. To answer RQ2, we map 2,233 memory corruption reports disclosed between 2016 and 2025 onto this taxonomy. To answer RQ3, we overlay a decade of academic browser fuzzers, classified by the targeted input class, onto the bug-density map. Our systematization reveals that current testing concentrates on well-explored components while bug-dense, high-impact surfaces remain insufficiently tested. Moreover, we identify three fuzzer deployment gaps, which are orthogonal to the academic efforts. Our work offers a structured foundation for future browser security research.