JavaScript engine flaws reveal how attacks chain and spread
When Flaws Cascade: Understanding Vulnerabilities and Exploitation Chains in JavaScript Engines
Cryptography and SecuritySoftware Engineering
Summary
JavaScript engines help run interactive websites but have many bugs that attackers try to exploit. The paper studies 241 real bugs in four popular engines to understand how problems start, what they look like, and how attackers chain them together to cause bigger security issues. The authors also analyze how these bugs can be stopped and offer advice to make engines safer. This helps developers protect browsers from complex attack strategies.
What this means in practice
- •For web browser developers: Improve browser security by targeting common root causes and attack chains found in JavaScript engine bugs to prevent complex exploits.
- •For software security engineers: Create more effective defenses by understanding key triggers and propagation of JavaScript engine vulnerabilities across different engines.
Authors
Yuhan Ma, Jiongchi Yu, Xiaofei Xie, Qiang Hu, Zhiyi Zhang, Junjie Wang
Abstract
JavaScript engines are pivotal to modern web browsers, enabling the execution of dynamic and interactive web applications. However, their complexity and widespread adoption make them prime targets for attackers exploiting vulnerabilities. While existing research has focused on detecting vulnerabilities of JavaScript engines, a significant gap remains in systematically understanding the characteristics of these vulnerabilities, including their symptoms, root causes, and exploitability. This paper bridges this gap by presenting the first comprehensive empirical study on vulnerabilities in JavaScript engines, investigating their characteristics and potential exploitation strategies. We construct a dataset comprising 241 vulnerabilities across four mainstream JavaScript engines from 2017 to 2024. Through in-depth analysis, we first develop taxonomies for symptoms and root causes. Building on this understanding, we investigate the exploitability of these vulnerabilities, identifying key prerequisites and extracting vulnerability trigger chains that demonstrate how logical errors propagate into memory safety violations. Additionally, we analyze the mitigation strategies to counter these exploits. Finally, we summarize key implications for various stakeholders, including developers and researchers, offering actionable insights to improve the security and resilience of JavaScript engines.