Collected research

The Devil is in the Constants: Bypassing Defenses in Browser JIT Engines

Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis and Sotiris Ioannidis · ndss-symposium.org

JavaScript integer constants survive into a JIT engine generated code, so an attacker can encode x86 gadget bytes as immediate values and make Firefox or Internet Explorer emit a full ROP chain at run time, defeating ASLR, DEP and the undocumented JIT hardening in IE. Gadgets can also be located on the fly, and blinding every constant costs up to 80 percent more instructions.

Record

Researcher

Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis and Sotiris Ioannidis

Published by

ndss-symposium.org

Format

Whitepaper

Topic

Browser

In the archive

• Collected in the 2015 research round

Tags

• gadget-chain
• rce
• javascript-runtime
• javascript
• mitigation
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis and Sotiris Ioannidis, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.