Exploiting WebAssembly for Evasive Code Execution over Modern Web Browsers

Abstract

WebAssembly has emerged as a paradigm shift in web development, providing performance-enhancing capabilities for networked web applications. It is designed as a compilation target for high-level languages, and is widely supported by 95.46% of popular modern browsers and platforms (e.g., Firefox, Chrome, Opera) as of May 2026. Its increasing popularity across client-server architectures has also attracted malicious actors to abuse this technology by distributing malware via WebAssembly modules, leading to its execution on the client side. However, existing studies and tools on the malicious WebAssembly module detection are inadequate as they typically focus only on specific malware types, rely on the source code, or do not account for evasion techniques in network-delivered payloads. In this paper, we introduce WASMWARE, a novel and unique class of WebAssembly-based attacks that exploit WebAssembly’s modular structure to inject malicious payloads in non-executable sections, thereby bypassing traditional detection systems. We demonstrate the effectiveness of WASMWARE through three representative attacks: Document Object Model (DOM) injection attack, file dropping attack, and stealthy page redirection attack. Afterward, we design and implement WASMGUARD, a learning-based defense mechanism that enables effective inspection of WebAssembly binaries within networked environments without requiring source code access. Our comprehensive evaluation of WASMGUARD shows an overall detection accuracy of 98.87% with an average F1 score of 98.79%.