The Problems and Promise of Web Assembly
Summary: Google Project Zero reviewed the WebAssembly implementations in all four major browsers and found three vulnerabilities, most occurring during the module parsing phase. The bugs include CVE-2018-4222, a double-added offset in WebKit's TypedArray handling that reads memory out of bounds; CVE-2018-6092, an integer overflow in Chrome when parsing a function's locals; and CVE-2018-4121, a WebKit section-order check reset after custom sections that allows sections to repeat in any order.
What you should know: CVE-2018-4121 was independently found by three MWR Labs researchers, and the section-order flaw alone would likely produce many subtle memory corruption issues because section order and uniqueness are fundamental to how WebAssembly binaries work. Every major browser shipped this attack surface, and the parsing code that loads a module is where Project Zero's bugs clustered.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-4222
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026