JavaScript Realms: The Blank Spot In Web App Runtime Security
summary
Web apps have a blind spot: same-origin child realms can evade runtime monkey patches and even import clean prototypes to manipulate the main window, so security and observability hooks miss injected code. The claim is concrete: third-party agents miss same-origin child Realms and thus leak sensitive localStorage and iframe SRC protections. The concrete fix is snow, a synchronous JavaScript shim that synchronously applies monkey patches to every new realm and currently protects metamask for ~30 million users.
AI-written summary · about
chapters (11)
- 0:00JavaScript Realms security intro
- 1:06Websites to web apps evolution
- 5:22Third-party solutions necessity
- 12:32What are JavaScript Realms
- 16:07Realms blank spot in security
- 20:07Solving Realms visibility gaps
- 23:14Snow JS for Realms security
- 26:26Snow JS vs Realms bypasses
- 30:46Snow JS future and adoption
- 31:50Live demo: Snow JS
- 34:01Q&A
related talks
30mAchieving the Web Isolation Nirvana - How far along are we?
34mReal World JavaScript Security
46mWhat Can Traditional Web App Security Learn From Browser Wallet Extensions?
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
36mHTML5 JS Security
48mPreloading Insecurity In Your Electron
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
48mSecurity Risk: Single-Page Applications.