[Paper Review] SOK: On the Analysis of Web Browser Security

Jung‐won Lim, Yonghwi Jin+7 more|arXiv (Cornell University)|Dec 31, 2021

Web Application Security Vulnerabilities4 citations

TL;DR

This paper presents a systematic analysis of modern web browser security by unifying the architectures of Chrome, Firefox, Safari, and Edge, and conducting a 10-year longitudinal study of browser bugs, exploits, and mitigations. It identifies key vulnerabilities, evaluates state-of-the-art bug-finding tools, and demonstrates the effectiveness of proactive defenses, offering actionable insights for future browser hardening and secure-by-design development.

ABSTRACT

Web browsers are integral parts of everyone's daily life. They are commonly used for security-critical and privacy sensitive tasks, like banking transactions and checking medical records. Unfortunately, modern web browsers are too complex to be bug free (e.g., 25 million lines of code in Chrome), and their role as an interface to the cyberspace makes them an attractive target for attacks. Accordingly, web browsers naturally become an arena for demonstrating advanced exploitation techniques by attackers and state-of-the-art defenses by browser vendors. Web browsers, arguably, are the most exciting place to learn the latest security issues and techniques, but remain as a black art to most security researchers because of their fast-changing characteristics and complex code bases. To bridge this gap, this paper attempts to systematize the security landscape of modern web browsers by studying the popular classes of security bugs, their exploitation techniques, and deployed defenses. More specifically, we first introduce a unified architecture that faithfully represents the security design of four major web browsers. Second, we share insights from a 10-year longitudinal study on browser bugs. Third, we present a timeline and context of mitigation schemes and their effectiveness. Fourth, we share our lessons from a full-chain exploit used in 2020 Pwn2Own competition. and the implication of bug bounty programs to web browser security. We believe that the key takeaways from this systematization can shed light on how to advance the status quo of modern web browsers, and, importantly, how to create secure yet complex software in the future.

Motivation & Objective

• To address the lack of holistic, objective systematization of browser security across major vendors despite their critical role in cyber security.
• To analyze the evolution of browser vulnerabilities, exploitation techniques, and mitigation strategies over a 10-year period.
• To evaluate the effectiveness of automated bug-finding tools like fuzzers and static analysis in detecting complex browser vulnerabilities.
• To demonstrate the value of proactive security measures through a real-world full-chain exploit from the 2020 Pwn2Own competition.
• To provide actionable insights for researchers and vendors to improve browser security through shared design principles and coordinated patching

Proposed method

• Developed a unified architectural model to compare and contrast the security design of Chrome, Firefox, Safari, and Edge, focusing on sandboxing and memory safety mechanisms.
• Conducted a 10-year longitudinal study of publicly reported browser vulnerabilities using CVEs, issue trackers, and vendor reports to identify trends in bug types and exploitability.
• Evaluated state-of-the-art fuzzing tools (e.g., ClusterFuzz, LangFuzz, DIE) and static analysis tools (e.g., SYS) for their ability to detect browser engine vulnerabilities.
• Analyzed a full-chain exploit from the 2020 Pwn2Own competition to reverse-engineer the attack chain and assess the effectiveness of existing mitigations.
• Proposed a proactive defense model where new mitigations (e.g., StructureID randomization) are deployed in isolated, safe browsing environments before public disclosure.
• Advocated for shared JavaScript engine libraries across browsers to enable faster, over-the-air patching and reduce the impact of homogeneity in browser engines.

Experimental results

Research questions

• RQ1 How do the security architectures of Chrome, Firefox, Safari, and Edge differ in terms of sandboxing and memory safety, and what are the implications for exploit surface?
• RQ2 What are the dominant classes of browser vulnerabilities over the past decade, and how have they evolved in response to new mitigation techniques?
• RQ3 To what extent do modern automated bug-finding tools (fuzzing and static analysis) succeed in detecting complex logic bugs in large-scale browser codebases?
• RQ4 How effective are proactive mitigation strategies in defending against zero-day exploits, and can they be deployed before public disclosure?
• RQ5 How does the homogeneity of browser engines amplify the impact of vulnerabilities, and what architectural changes could improve coordinated patching?

Key findings

• Fuzzing tools like ClusterFuzz have found over 29,000 bugs in Chrome alone, with industrial-scale fuzzers (e.g., 25,000-core clusters) significantly outperforming academic tools.
• Static analysis tools like SYS show promise in scaling to large browser codebases by focusing symbolic execution on high-risk code regions identified via static checks.
• Despite advances, automated tools still cannot replace manual code audits for detecting complex logic bugs, highlighting a critical gap in current vulnerability discovery.
• Site Isolation, originally designed to prevent UXSS, also mitigated Spectre/Meltdown attacks—demonstrating the value of proactive, defense-in-depth security designs.
• The homogeneity of browser engines (e.g., V8, JavaScriptCore) means a single vulnerability can affect multiple browsers, increasing the need for shared, patchable engine libraries.
• Deploying new mitigations (e.g., StructureID randomization) in isolated, safe browsing sandboxes before public release could detect and block zero-day exploits in the wild.