~jpastuszek/blog

101a240835f049048f7cf4525043817d75da0b43 — Jakub Pastuszek 3 years ago 1de16a5
typos
1 files changed, 2 insertions(+), 2 deletions(-)

M content/2020-08-14-js/index.md
M content/2020-08-14-js/index.md => content/2020-08-14-js/index.md +2 -2
@@ 66,12 66,12 @@ Execution of arbitrary code on your computer is not without risks.
Web browser designers try very hard to make sure that any script running within the browser is contained and won't be able to access data beyond what browser will allow it to access.
In practice, this is impossible to achieve.

### JaveScript interpreter bugs
### JavaScript interpreter bugs

Every script downloaded by the browser is parsed and executed with [JavaScript] virtual machine (or [WebAssembly] runtime environment) that is a component of the browser.
These virtual machines are designed in such a way that restricts the running script from accessing arbitrary information on your computer. This is called sandboxing.

In practice, the design and implementation are not perfect. Cleaver trick may allow script code to access restricted information from the browser or operating system. It may even allow injecting native code to be executed as part of normal browser runtime ([Remote Code Execution]). This in effect can lead to the compromise of the whole system.
In practice, the design and implementation are not perfect. Clever trick may allow script code to access restricted information from the browser or operating system. It may even allow injecting native code to be executed as part of normal browser runtime ([Remote Code Execution]). This in effect can lead to the compromise of the whole system.

Unfortunately, every few months browser vendors patch their [JavaScript] virtual machines to fix this kind of issues.