Weaver: Fuzzing JavaScript Engines at the JavaScript-WebAssembly Boundary

• URL: http://arxiv.org/abs/2603.18789v1
• Date: Thu, 19 Mar 2026 11:40:09 GMT
• Title: Weaver: Fuzzing JavaScript Engines at the JavaScript-WebAssembly Boundary
• Abstract summary: This paper proposes Weaver, an effective greybox fuzzing framework specifically tailored to uncover vulnerabilities at the JS-Wasm boundary.<n>Weaver achieves superior code coverage compared to state-of-the-art fuzzers.<n>Weaver has uncovered two new bugs in the latest versions of these engines, one of which is considered high severity and set to highest priority.
• Score: 38.40644209322628
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The security of modern JavaScript (JS) engines is critical since they provide the primary defense mechanism for executing untrusted code on the web. The recent integration of WebAssembly (Wasm) has transformed these engines into complex polyglot environments, creating a novel attack surface at the JS-Wasm interaction boundary due to the distinct type systems and memory models of two languages. This boundary remains largely underexplored, as previous works mainly focus on testing JS and Wasm as two isolated entities rather than investigating the security implications of their cross-language interactions. This paper proposes Weaver, an effective greybox fuzzing framework specifically tailored to uncover vulnerabilities at the JS-Wasm boundary. To comply with the language constraints, Weaver uses a type-aware generation strategy, meticulously maintaining the dual-type representation for every generated variables. This allows fuzzer to validly utilize variables across the language boundary. Besides, Weaver leverages the UCB-1 algorithm to intelligently schedule mutators and generators to maximize the discovery of new code paths. We have implemented and evaluated Weaver on three JS engines. The results indicate that Weaver achieves superior code coverage compared to state-of-the-art fuzzers. Moreover, Weaver has uncovered two new bugs in the latest versions of these engines, one of which is considered high severity and set to highest priority, demonstrating the practicality of Weaver.

Related papers

• SOS! : A Streamlined Object-Conditional Transformer for Model-free Segmentation [67.361660179434]
  We propose SOS (Streamlined Object-conditional Transformer for model-free pipelines) for unseen objects segmentation.<n>Central to our framework is a novel Object-Conditional Transformer that learns identity-anchored queries, unifying mask generation and target identification into a single feed-forward pass.<n>Sos establishes a new state-of-the-art for model-free unseen objects segmentation, delivering accurate and high-efficiency performance.
  arXiv  Detail & Related papers  (2026-08-15T15:53:23Z)
• WebVIA: A Web-based Vision-Language Agentic Framework for Interactive and Verifiable UI-to-Code Generation [30.193562985137813]
  We propose WebVIA, the first agentic framework for interactive UI-to-Code generation and validation.<n>The framework comprises three components: 1) an exploration agent to capture multi-state UI screenshots; 2) a UI2Code model that generates executable interactive code; 3) a validation module that verifies the interactivity.
  arXiv  Detail & Related papers  (2025-11-09T06:58:52Z)
• Realistic Environmental Injection Attacks on GUI Agents [6.38492008798679]
  GUI agents built on LVLMs are increasingly used to interact with websites.<n>Their exposure to open-world content makes them vulnerable to Environmental Injection Attacks (EIAs)<n>We propose Chameleon, an attack framework with two main novelties.
  arXiv  Detail & Related papers  (2025-09-14T12:47:54Z)
• Empirical Security Analysis of Software-based Fault Isolation through Controlled Fault Injection [21.57370108666908]
  Google's V8 heap sandbox protects billions of users across all Chromium-based browsers and countless applications built on Node$.$js and Electron.<n>Despite their widespread use, such SFI mechanisms have seen little security testing.<n>We propose a new testing technique that models the security boundary of modern SFI implementations.
  arXiv  Detail & Related papers  (2025-09-09T13:56:17Z)
• DoomArena: A framework for Testing AI Agents Against Evolving Security Threats [81.73540246946015]
  We present DoomArena, a security evaluation framework for AI agents.<n>It is a plug-in framework and integrates easily into realistic agentic frameworks.<n>It is modular and decouples the development of attacks from details of the environment in which the agent is deployed.
  arXiv  Detail & Related papers  (2025-04-18T20:36:10Z)
• DarthShader: Fuzzing WebGPU Shader Translators & Compilers [19.345967816562364]
  A recent trend towards running more demanding web applications has led to the adoption of the WebGPU standard. This opens up a new attack surface: Untrusted web content is passed through to the GPU stack, which traditionally has been optimized for performance instead of security. DarthShader is the first language fuzzer that combines mutators based on an intermediate representation with those using a more traditional abstract syntax tree.
  arXiv  Detail & Related papers  (2024-09-03T12:06:19Z)
• FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques [53.288368877654705]
  FV8 is a modified V8 JavaScript engine designed to identify evasion techniques in JavaScript code. It selectively enforces code execution on APIs that conditionally inject dynamic code. It identifies 1,443 npm packages and 164 (82%) extensions containing at least one type of evasion.
  arXiv  Detail & Related papers  (2024-05-21T19:54:19Z)
• AutoScraper: A Progressive Understanding Web Agent for Web Scraper Generation [54.17246674188208]
  Web scraping is a powerful technique that extracts data from websites, enabling automated data collection, enhancing data analysis capabilities, and minimizing manual data entry efforts. Existing methods, wrappers-based methods suffer from limited adaptability and scalability when faced with a new website. We introduce the paradigm of generating web scrapers with large language models (LLMs) and propose AutoScraper, a two-stage framework that can handle diverse and changing web environments more efficiently.
  arXiv  Detail & Related papers  (2024-04-19T09:59:44Z)
• Static Semantics Reconstruction for Enhancing JavaScript-WebAssembly Multilingual Malware Detection [51.15122099046214]
  WebAssembly allows attackers to hide the malicious functionalities of JavaScript malware in cross-language interoperations. The detection of JavaScript-WebAssembly multilingual malware (JWMM) is challenging due to the complex interoperations and semantic diversity between JavaScript and WebAssembly. We present JWBinder, the first technique aimed at enhancing the static detection of JWMM.
  arXiv  Detail & Related papers  (2023-10-26T10:59:45Z)
• Montage: A Neural Network Language Model-Guided JavaScript Engine Fuzzer [18.908548472588976]
  We present Montage, the first NNLM-guided fuzzer for finding JS engine vulnerabilities. Montage found 37 real-world bugs, including three CVEs, in the latest JS engines.
  arXiv  Detail & Related papers  (2020-01-13T08:45:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.