CHERI extends a conventional RISC Instruction-Set Architecture, compiler, and operating
system to support fine-grained, capability-based memory protection to mitigate memory …

A wide variety of smartphone applications today rely on third-party advertising services,
which provide libraries that are linked into the hosting application. This situation is …

How a sidekick scripting language for Java, created at Netscape in a ten-day hack, ships first
as a de facto Web standard and eventually becomes the world's most widely used …

We reduce JavaScript to a core calculus structured as a small-step operational semantics.
We present several peculiarities of the language and show that our calculus models them …

Security isolation is a foundation of computing systems that enables resilience to different
forms of attacks. This article seeks to understand existing security isolation techniques by …

Much of the power of modern Web comes from the ability of a Web page to combine content
and JavaScript code from disparate servers on the same page. While the ability to create …

The advent of Web 2.0 has lead to the proliferation of client-side code that is typically written
in JavaScript. This code is often combined—or mashed-up—with other code and content …

We present FlowFox, the first fully functional web browser that implements a precise and
general information flow control mechanism for web scripts based on the technique of …

Current proposals for adding gradual typing to JavaScript, such as Closure, TypeScript and
Dart, forgo soundness to deal with issues of scale, code reuse, and popular programming …

Modern extensible web platforms like Facebook and Yammer depend on third-party
software to offer a rich experience to their users. Unfortunately, users running a third-party …