JavaScript Zero: Real JavaScript and Zero Side-Channel Attacks

Michael Schwarz, Moritz Lipp, Daniel Gruss

Research output: Chapter in Book/Report/Conference proceedingConference paperpeer-review


Modern web browsers are ubiquitously used by billions of users, connecting them to the world wide web. From the other side, web browsers do not only provide a unified interface for businesses to reach customers, but   they also provide a unified interface for malicious actors to reach users. The highly optimized scripting language JavaScript plays an important role in the modern web, as well as for browser-based attacks. These attacks include microarchitectural attacks, which exploit the design of the underlying hardware. In contrast to software bugs, there is often no easy fix for microarchitectural attacks.

We propose JavaScript Zero, a highly practical and generic fine-grained permission model in JavaScript to reduce the attack surface in modern browsers. JavaScript Zero facilitates advanced features of the JavaScript  language to dynamically deflect usage of dangerous JavaScript features. To implement JavaScript Zero in practice, we overcame a series of challenges to protect potentially dangerous features, guarantee the completeness of our solution, and provide full compatibility with all websites. We demonstrate that our proof-of-concept browser extension Chrome Zero protects against 11 unfixed state-of-the-art microarchitectural and side-channel attacks. As a side effect, Chrome Zero also protects against 50 % of the published JavaScript 0-day exploits since Chrome 49. Chrome Zero has a performance overhead of 1.82% on average. In a user study, we found that for 24 websites in the Alexa Top 25, users could not distinguish browsers with and without Chrome Zero correctly, showing that Chrome Zero has no perceivable effect on most websites. Hence, JavaScript Zero is a practical  solution to mitigate JavaScript-based state-of-the-art microarchitectural and side-channel attacks.
Original languageEnglish
Title of host publicationNetwork and Distributed System Security Symposium 2018
Publication statusPublished - 18 Feb 2018
EventNetwork and Distributed System Security Symposium 2018 - Catamaran Resort Hotel and Spa, San Diego, United States
Duration: 18 Feb 201821 Feb 2018


ConferenceNetwork and Distributed System Security Symposium 2018
Abbreviated titleNDSS'18
Country/TerritoryUnited States
CitySan Diego
Internet address

Cite this