Webassembly Security

WebAssembly (Wasm) enables execution of memory-unsafe languages like C/C++ in the browser, but its monolithic linear memory leaves modules vulnerable to high-impact attacks such as cross-site scripting. Existing defenses are unsuitable for commercial-off-the-shelf (COTS) binaries, requiring either source code, non-standard runtimes, or introduce high-overhead instrumentation.

We present Bento, the first static binary rewriter that automatically hardens COTS Wasm modules. Bento uses whole-program pointer analysis to partition memory into logical regions (stack, heap, globals) and rewrites the binary to map each region to an isolated instance using the standard Wasm multi-memory feature. This creates a software-based MMU that provides architectural hardening without adding instructions or costly runtime checks.

Our evaluation shows that Bento mitigates real-world exploits in prominent applications, including Libpng and PDFAlto, while preserving program semantics, as confirmed by differential testing. Since our architectural approach adds no new instructions, Bento only induces 3% runtime slowdown and a 1% startup overhead.

Publication

Oussama Draissi and Lucas Davi: Bento: Fine-Grained Memory Isolation for COTS WebAssembly Binaries. In: Proc. of 35th ACM Web Conference 2026 (WWW '26), Association for Computing Machinery (ACM), Dubai, United Arab Emirates, apr 2026.

WebAssembly enables fast execution of performance-critical in web applications utilizing native code. However, recent research has demonstrated the potential for memory corruption errors within WebAssembly modules to exploit web applications. In this work, we present the first systematic analysis of memory corruption in WebAssembly, unveiling the prevalence of a novel threat model where memory corruption enables code injection on a victim’s browser. Our large-scale analysis across 37797 domains reveals that an alarming 29411 (77.81%) of those fully trust data coming from potentially attacker-controlled sources. As a result, an attacker can exploit memory errors to manipulate the WebAssembly memory, where the data is implicitly trusted and frequently passed into security-sensitive functions such as eval or directly into the DOM via innerHTML. Thus, an attacker can abuse this trust to gain JavaScript code execution, i.e., Cross-Site Scripting (XSS).

To tackle this issue, we present Wemby, the first viable approach to efficiently analyze WebAssembly-powered websites holistically. We demonstrate that Wemby is proficient at detecting remotely exposed memory corruption errors in web applications through fuzzing. For this purpose, we implement binary-only WebAssembly instrumentation that provides fine-grained memory corruption oracles. We applied Wemby to different websites, uncovering several memory corruption bugs, including one on the Zoom platform. In terms of performance, our ablation study demonstrates that Wemby outperforms current WebAssembly fuzzers. Specifically, Wemby achieves an average speed improvement of 232 times and delivers 46% greater code coverage compared to the state-of-the-art.

Publication

Oussama Draissi, Tobias Cloosters, David Klein, Michael Rodler, Marius Musch, Martin Johns and Lucas Davi: Wemby’s Web: Hunting for Memory Corruption in WebAssembly. In: ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), Association for Computing Machinery (ACM), Trondheim, Norway, 34. Edition, jun 2025.

WebAssembly's (Wasm) monolithic linear memory model facilitates memory corruption attacks that can escalate to cross-site scripting in browsers or go undetected when a malicious host tampers with a module's state. Existing defenses rely on invasive binary instrumentation or custom runtimes, and do not address runtime integrity verification under an adversarial host model. We present Walma, a framework for WebAssembly Linear Memory Attestation that leverages machine learning to detect memory corruption and external tampering by classifying memory snapshots. We evaluate Walma on six real-world CVE-affected applications across three verification backends (cpu-wasm, cpu-tch, gpu) and three instrumentation policies. Our results demonstrate that CNN-based classification can effectively detect memory corruption in applications with structured memory layouts, with coarse-grained boundary checks incurring as low as 1.07x overhead, while fine-grained monitoring introduces higher (1.5x--1.8x) but predictable costs. Our evaluation quantifies the accuracy and overhead trade-offs across deployment configurations, demonstrating the practical feasibility of ML-based memory attestation for WebAssembly.

WebAssembly (Wasm) allows execution of C/C++ programs in a sandboxed web browser environment. While Wasm enforces control-flow integrity and software fault isolation, it lacks support for memory randomization and operates on a fully deterministic linear memory across multiple instantiations. As such, memory safety attacks, especially data-only exploits, remain a persistent threat in Wasm. To address this limitation, we developed Waslr, the first system to enforce fine-grained randomization and per-instantiation security for Wasm modules. Each module load replaces Wasm’s deterministic layout with a fresh, unpredictable one, reducing a certain address guess to a probability as low as 1/6.4M. All randomization logic is embedded into the compiled binary using only standard Wasm features, running on any unmodified browser or standalone engine. Our evaluation on WABench and three real-world CVEs shows 3–8% wall-clock overhead, which is an order of magnitude below the state-of-the-art