Virtual browser: a virtualized browser to sandbox third-party JavaScripts with enhanced security

摘要: Third party JavaScripts not only offer much richer features to the web and its applications but also introduce new threats. These scripts cannot be completely trusted executed with privileges given host sites. Due incomplete virtualization lack of tracking all data flows, existing approaches without native sandbox support can secure a subset third JavaScripts, they are vulnerable attacks encoded in non-standard HTML/-JavaScript (browser quirks) as these will parse independently at server side considering client-side parsing quirks. At same time, sandboxes based on unknown JavaScript engine bugs.In this paper, we propose Virtual Browser, full browser-level virtualized environment within browsers for executing untrusted code. Our approach supports more complete language including those hard-to-secure functions, such eval. Since Browser does rely browser behavior, there is no possibility being through Moreover, third-party Javascripts running instead browsers, it harder attackers exploit vulnerabilities engine. In our design, first isolate from components then communication by adding flows carefully examined security. The evaluation prototype shows that execution speed Microsoft Web Sandbox[5], state art runtime web-level sandbox. addition, development.