US 2025/0028585 A1 · DETECTING WEBASSEMBLY-BASED BROWSER EXPLOITS

Abstract

An exploit detector hooks functions of a WebAssembly engine API that include functions invoked when creating a WebAssembly instance, when permissibly modifying read-write-execute (RWX) memory allocated for a WebAssembly instance, and when calling an exported WebAssembly function. Upon invocation of the hooked instance creation function(s), the detector obtains an address of RWX memory allocated for the instance, reads data stored there, and records an association between the address and the data. If the hooked function(s) for permissibly modifying RWX memory is invoked, the detector updates the data stored in the recorded association with the modified data read from the RWX memory. Based on invocation of the hooked function(s) associated with WebAssembly export function calls, the detector reads the current data in the RWX memory to be executed and compares this data to the data recorded in association with the address. If the actual and expected data differ, the detector detects a browser exploit.

Claims20

Dependent claims

A method comprising:

installing a plurality of code hooks for a corresponding plurality of functions of an application programming interface (API) of a WebAssembly engine for a web browser;
based on invocation of a first function of the plurality of functions, determining an address of memory allocated for a WebAssembly instance and recording first contents read from the memory, wherein the memory has read-write-execute permissions;
based on invocation of a second function of the plurality of functions, reading second contents from the memory allocated to the WebAssembly instance;
determining if the first contents and the second contents of the memory differ;
and
based on determining that the first contents and the second contents differ, determining that the web browser has been exploited.

3 more elements

An apparatus comprising:

a processor;
and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
install a plurality of code hooks into a corresponding plurality of functions of a WebAssembly engine application programming interface (API);
based on creation of a WebAssembly instance triggering a first of the plurality of code hooks, determine a memory address associated with read-write-execute (RWX) memory allocated for the WebAssembly instance;
record memory contents read from the memory address, wherein the memory contents have RWX permissions;
based on a call to an exported function of the WebAssembly instance triggering a second of the plurality of code hooks, compare current memory contents of the RWX memory with the recorded memory contents;
and
based on a determination that the current memory contents and the recorded memory contents differ, detect a browser exploit.

6 more elements

Dependencies are inferred from the claim text.

Detecting webassembly-based browser exploits

Life of this patent

Detecting webassembly-based browser exploits

Life of this patent

Abstract

Claims20