Attacking the WebAssembly Compiler of WebKit
summary
Shows an end-to-end technique that migrates a Wasm generator into the WebKit backend so a fuzzer built for V8 exercises WebAssembly in Safari without heavy rework. Reports 13 security issues found within a day of fuzzing, affecting the interpreter, B3/air and OMG compilers; examples include a stack‑overflow prologue ordering bug, a delegate/catch stack‑balance bug, and a missing callsite index in stack maps. Also describes a 5× fuzzing speedup from shared‑memory and process tweaks and the exact code fixes used.
AI-written summary · about
chapters (5)
- 0:00WebAssembly compiler research
- 3:45Focus on WebKit's compiler
- 8:40Fuzzer migration strategy
- 13:46WebKit WebAssembly vulnerabilities
- 25:39Summary and future
related talks
43mWebAssembly Is All You Need:Exploiting Chrome and the V8 Sandbox 10+ times with WASM
21mTwo-Faces of WASM Security
17mWaltzz: WebAssembly Runtime Fuzzing with Stack-Invariant Transformation
33mWebKit Everywhere: Secure or Not?
34mPanel Discussion: Browsers & Wasm
27mNew Attack Surface in Safari: Using Just One Web Audio Vulnerability to Rule Safari
50mAn Introduction to WebAssembly
46mWebAssembly (Digging a bit deeper)