JavaScript security: the elephant running in your browser

John Graham-Cumming

Visit any major website, such as a bank or a retailer, and your web browser will run small pieces of JavaScript for web analytics, ad serving, automatic offer targeting or recommendations. These so-called tags weren't written by the owner of the website but were provided by a third party. Yet JavaScript's security model, or lack of it, means that any piece of JavaScript in a page can interact with any other piece and with the page itself. So, how does a major bank or retailer know that this code isn't malicious? And where did the code come from? In most cases the website owner has little idea what the codes does, and it typically gets delivered by unsecured email.

This paper and talk look at the risks, both technical and procedural, of the current state of JavaScript page tagging with specific examples from actual websites. It then examines the projects such as CAJA, adSAFE and jsHub that attempt to eliminate this sorry, and potentially disastrous, state of affairs.


We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.