{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:02:54Z","timestamp":1782975774058,"version":"3.54.5"},"reference-count":76,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00115","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"3281-3300","source":"Crossref","is-referenced-by-count":0,"title":["Best of Both Worlds: Effective Foreign Bridge Identification in V8 Embedders for Security Analysis"],"prefix":"10.1109","author":[{"given":"Georgios","family":"Alexopoulos","sequence":"first","affiliation":[{"name":"University of Athens"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Thodoris","family":"Sotiropoulos","sequence":"additional","affiliation":[{"name":"ETH Zurich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhendong","family":"Su","sequence":"additional","affiliation":[{"name":"ETH Zurich"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dimitris","family":"Mitropoulos","sequence":"additional","affiliation":[{"name":"University of Athens"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/3696410.3714878"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3395363.3397368"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3691620.3696193"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106267"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/SPW59333.2023.00036"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.68"},{"key":"ref7","first-page":"246","article-title":"Is Rust used safely by software developers?","volume-title":"Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering, ser. ICSE \u201920","author":"Evans","year":"2020"},{"key":"ref8","article-title":"Everything old is new again: binary security of webassembly","volume-title":"Proceedings of the 29th USENIX Conference on Security Symposium, ser. SEC\u201920","author":"Lehmann","year":"2020"},{"key":"ref9","first-page":"6133","article-title":"Bilingual problems: Studying the security risks incurred by native extensions in scripting languages","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Staicu","year":"2023"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3623140"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3523262"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3510457.3513044"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484535"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP63326.2025.00018"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607233"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616609"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616299"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616268"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690332"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/3579856.3595799"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3579856.3590330"},{"key":"ref22","volume-title":"node-addon-api module","year":"2025"},{"key":"ref23","volume-title":"bug: fix segfault of invalid toString() object","year":"2022"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3660821"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/SANER56733.2023.00024"},{"key":"ref26","article-title":"PyXray: Practical cross-language call graph construction through object layout analysis","volume-title":"Proceedings of the IEEE\/ACM 48th International Conference on Software Engineering, ser. ICSE \u201926","author":"Alexopoulos","year":"2026"},{"key":"ref27","volume-title":"GDB: The GNU Debugger","year":"2025"},{"key":"ref28","first-page":"829","article-title":"X-force: forceexecuting binary programs for security applications","volume-title":"Proceedings of the 23rd USENIX Conference on Security Symposium, ser. SEC\u201914","author":"Peng","year":"2014"},{"key":"ref29","article-title":"The JSAPI User Guide","year":"2025","journal-title":"The JSAPI User Guide"},{"key":"ref30","volume-title":"Fast JavaScript\/Native Interfacing","year":"2025"},{"key":"ref31","volume-title":"The LLDB Debugger","year":"2025"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"ref33","first-page":"28","article-title":"AddressSanitizer: a fast address sanity checker","volume-title":"Proceedings of the 2012 USENIX Conference on Annual Technical Conference, ser. USENIX ATC\u201912","author":"Serebryany","year":"2012"},{"key":"ref34","volume-title":"String length limit is small-ish","year":"2017"},{"key":"ref35","volume-title":"Cross-platform asyncronous I\/O","year":"2025"},{"key":"ref36","volume-title":"CVE-2022\u201325324","year":"2022"},{"key":"ref37","volume-title":"CVE-2022\u201321144","year":"2022"},{"key":"ref38","article-title":"CVE-2022\u201321227","year":"2022","journal-title":"National Institute of Standards and Technology"},{"key":"ref39","article-title":"CVE-2022\u201325852","year":"2022","journal-title":"National Institute of Standards and Technology"},{"key":"ref40","article-title":"CVE-2022\u201325345","year":"2022","journal-title":"National Institute of Standards and Technology"},{"key":"ref41","article-title":"CVE-2024\u201321526","year":"2024","journal-title":"National Institute of Standards and Technology"},{"key":"ref42","article-title":"CVE-2022\u201321164","year":"2022","journal-title":"National Institute of Standards and Technology"},{"key":"ref43","article-title":"CVE-2024\u201334394","year":"2024","journal-title":"National Institute of Standards and Technology"},{"key":"ref44","article-title":"CVE-2025\u20133194","year":"2025","journal-title":"National Institute of Standards and Technology"},{"key":"ref45","article-title":"GHSA-9v62\u201324cr-58cx","year":"2022","journal-title":"GitHub Advisory Database"},{"key":"ref46","volume-title":"GitHub Advisory Database","year":"2019"},{"key":"ref47","volume-title":"Jelly: A static call graph generator for javascript","year":"2022"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464836"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3428255"},{"key":"ref50","volume-title":"Ghidra","author":"M\u00f8ller","year":"2025"},{"key":"ref51","article-title":"News and updates from the Project Zero team at Google","year":"2025","journal-title":"Google"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/2517349.2522728"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3582016.3582053"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/icse.2019.00038"},{"key":"ref55","first-page":"250","article-title":"Hybridroid: static analysis framework for android hybrid applications","volume-title":"Proceedings of the 31st IEEE\/ACM International Conference on Automated Software Engineering, ser. ASE \u201916","author":"Lee","year":"2016"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2018.2855650"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670331"},{"key":"ref58","first-page":"2513","article-title":"PolyCruise: A CrossLanguage dynamic information flow analysis","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Li","year":"2022"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-88806-0_16"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1002\/spe.3199"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/icse.2019.00038"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/2970276.2970368"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-30806-7_5"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE43902.2021.00122"},{"key":"ref65","first-page":"127","article-title":"Broadening horizons of multilingual static analysis: Semantic summary extraction from C code for JNI program analysis","volume-title":"2020 35th IEEE\/ACM International Conference on Automated Software Engineering (ASE)","author":"Lee","year":"2020"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3241639"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/1297027.1297031"},{"key":"ref68","first-page":"365","article-title":"An empirical security study of the native code in the jdk","volume-title":"Proceedings of the 17th Conference on Security Symposium, ser. SS\u201908. USA: USENIX Association","author":"Tan","year":"2008"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23131"},{"key":"ref70","article-title":"Retrofitting fine grain isolation in the firefox renderer","volume-title":"Proceedings of the 29th USENIX Conference on Security Symposium, ser. SEC\u201920","author":"Narayan","year":"2020"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3571208"},{"key":"ref72","first-page":"101","article-title":"Software ecosystem call graph for dependency management","volume-title":"Proceedings of the 40th International Conference on Software Engineering: New Ideas and Emerging Results, ser. ICSE-NIER \u201918","author":"Hejderup","year":"2018"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/SANER56733.2023.00028"},{"key":"ref74","volume-title":"Unsafe fast JS calls","author":"Stepanyan","year":"2020"},{"key":"ref75","volume-title":"Omnibox API implementation","author":"Project","year":"2024"},{"key":"ref76","volume-title":"Chrome Extensions: API Reference","year":"2025"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573521.pdf?arnumber=11573521","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:33:55Z","timestamp":1782970435000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573521\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":76,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00115","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}