Ryan Williams
Ryan Williams

WASP: Measuring Vulnerability Preservation Across the Native→WebAssembly Boundary

Northeastern University

WASP (WebAssembly Silent Preservation) is an empirical measurement study that asks a single question: when C/C++ memory-safety vulnerabilities are compiled to WebAssembly, are they still triggerable, and how does their observable behavior change?

The headline result is that compiling to Wasm rarely removes a memory-safety vulnerability -- it mostly makes it invisible. Every measured native memory-safety bug still triggers in Wasm, but in optimized (-O2) builds most do so with no observable signal in an uninstrumented runtime.

Research Questions

  • Triggering rate. What fraction of memory-safety vulnerabilities that trigger natively also trigger when compiled to WebAssembly?

  • Manifestation transformation. Among preserved vulnerabilities, how often does the compilation boundary change the bug class, observability, or exploitability?

  • Observability inversion. Does Wasm compilation make some vulnerabilities more observable and others less, relative to native uninstrumented execution?

Method

For each curated case, WASP builds a variant matrix -- vulnerable vs. patched, across optimization levels, with and without AddressSanitizer instrumentation -- and compiles each variant to WebAssembly via Emscripten/wasi-sdk. It executes every variant through a native executor (clang + ASan) and a Wasm executor (Wasmtime), then compares behavior to produce a structured verdict.

Verdicts separate vulnerabilities that remain observable without instrumentation from those that are silently preserved: the root-cause undefined behavior still executes (ASan-for-Wasm fires), but an uninstrumented runtime shows no trap, crash, or visible effect. A second layer of facets records bug-class fidelity, observability shift, and exploitability delta.

Implementation

WASP is implemented entirely in Rust as an oracle harness -- native and Wasm executors, a variant-matrix runner, a verdict classifier, and a report generator behind a single CLI. The catalog covers real CVEs across several widely used C/C++ projects (zlib, brotli, libpng, FreeType, libtiff, jq, libsndfile, libxml2) alongside synthetic cases spanning multiple CWE classes.