{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,2]],"date-time":"2025-08-02T19:01:49Z","timestamp":1754161309339,"version":"3.41.2"},"publisher-location":"New York, NY, USA","reference-count":61,"publisher":"ACM","content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,6,23]]},"DOI":"10.1145\/3696630.3728570","type":"proceedings-article","created":{"date-parts":[[2025,7,28]],"date-time":"2025-07-28T19:09:27Z","timestamp":1753729767000},"page":"480-490","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["The Promise and Pitfalls of WebAssembly: Perspectives from the Industry"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-9980-7298","authenticated-orcid":false,"given":"Ningyu","family":"He","sequence":"first","affiliation":[{"name":"The Hong Kong Polytechnic University, Hong Kong, Hong Kong"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-4557-3813","authenticated-orcid":false,"given":"Shangtong","family":"Cao","sequence":"additional","affiliation":[{"name":"Beijing University of Posts and Telecommunications, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1100-8633","authenticated-orcid":false,"given":"Haoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5064-5286","authenticated-orcid":false,"given":"Yao","family":"Guo","sequence":"additional","affiliation":[{"name":"Peking University, Beijing, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9082-3208","authenticated-orcid":false,"given":"Xiapu","family":"Luo","sequence":"additional","affiliation":[{"name":"The Hong Kong Polytechnic University, Hong Kong, Hong Kong"}]}],"member":"320","published-online":{"date-parts":[[2025,7,28]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2023. AutoCAD Web App. https:\/\/madewithwebassembly.com\/showcase\/autocad\/"},{"key":"e_1_3_2_1_2_1","unstructured":"2023. Complaint about large size of Go-compiled Wasm binaries. https:\/\/www.reddit.com\/r\/golang\/comments\/15yi9ub\/why_is_gos_wasm_so_slow_and_big_compared_with\/"},{"key":"e_1_3_2_1_3_1","unstructured":"2023. VirusTotal official website. https:\/\/www.virustotal.com"},{"key":"e_1_3_2_1_4_1","unstructured":"2024. Definition of WWW. https:\/\/en.wikipedia.org\/wiki\/World_Wide_Web"},{"key":"e_1_3_2_1_5_1","unstructured":"any.run. 2023. The analysis of the website www.hostingcloud.racing. https:\/\/any.run\/report\/44e8158b003fcac5151ece925d2d1d1160583ef6e21a8100c5c43ae41dfbad46\/955837c9-1eb5-42d3-8425-06f770730773"},{"key":"e_1_3_2_1_6_1","unstructured":"backblaze. 2023. Threat Analysis Firm Taps Backblaze in the Fight Against Cybercrime. https:\/\/www.backblaze.com\/cloud-storage\/case-studies\/urlscan-io"},{"key":"e_1_3_2_1_7_1","volume-title":"Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. 2685\u20132687","author":"Bian Weikang","year":"2019","unstructured":"Weikang Bian, Wei Meng, and Yi Wang. 2019. Poster: Detecting webassembly-based cryptocurrency mining. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security. 2685\u20132687."},{"key":"e_1_3_2_1_8_1","unstructured":"Bytecode Alliance. 2024. Documentation of component model. https:\/\/component-model.bytecodealliance.org"},{"key":"e_1_3_2_1_9_1","unstructured":"caniuse. 2024. caniuse webpage. https:\/\/caniuse.com\/wasm"},{"key":"e_1_3_2_1_10_1","volume-title":"BREWasm: A General Static Binary Rewriting Framework for WebAssembly. In International Static Analysis Symposium. Springer, 139\u2013163","author":"Cao Shangtong","year":"2023","unstructured":"Shangtong Cao, Ningyu He, Yao Guo, and Haoyu Wang. 2023. BREWasm: A General Static Binary Rewriting Framework for WebAssembly. In International Static Analysis Symposium. Springer, 139\u2013163."},{"key":"e_1_3_2_1_11_1","unstructured":"Cisco. 2023. Cisco Umbrella Top 1 Million list. https:\/\/s3-us-west-1.amazonaws.com\/umbrella-static\/index.html"},{"key":"e_1_3_2_1_12_1","unstructured":"coinhive. 2023. Github coinhive repository. https:\/\/github.com\/cazala\/coin-hive"},{"key":"e_1_3_2_1_13_1","unstructured":"Emscripten. 2023. The dlmalloc implementation of Emscripten. https:\/\/github.com\/emscripten-core\/emscripten\/blob\/main\/system\/lib\/dlmalloc.c"},{"key":"e_1_3_2_1_14_1","unstructured":"EmulatorJS. 2023. The EmulatorJS official website. https:\/\/emulatorjs.org\/"},{"key":"e_1_3_2_1_15_1","unstructured":"Go. 2023. The malloc implementation of Go. https:\/\/go.dev\/src\/runtime\/malloc.go"},{"key":"e_1_3_2_1_16_1","volume-title":"Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation. 185\u2013200","author":"Haas Andreas","year":"2017","unstructured":"Andreas Haas, Andreas Rossberg, Derek L Schuff, Ben L Titzer, Michael Holman, Dan Gohman, Luke Wagner, Alon Zakai, and JF Bastien. 2017. Bringing the web up to speed with WebAssembly. In Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation. 185\u2013200."},{"key":"e_1_3_2_1_17_1","volume-title":"Eunomia: Enabling User-specified Fine-Grained Search in Symbolically Executing WebAssembly Binaries. arXiv preprint arXiv:2304.07204","author":"He Ningyu","year":"2023","unstructured":"Ningyu He, Zhehao Zhao, Jikai Wang, Yubin Hu, Shengjian Guo, Haoyu Wang, Guangtai Liang, Ding Li, Xiangqun Chen, and Yao Guo. 2023. Eunomia: Enabling User-specified Fine-Grained Search in Symbolically Executing WebAssembly Binaries. arXiv preprint arXiv:2304.07204 (2023)."},{"key":"e_1_3_2_1_18_1","volume-title":"Proceedings of the web conference","author":"Hilbig Aaron","year":"2021","unstructured":"Aaron Hilbig, Daniel Lehmann, and Michael Pradel. 2021. An empirical study of real-world webassembly binaries: Security, languages, use cases. In Proceedings of the web conference 2021. 2696\u20132708."},{"key":"e_1_3_2_1_19_1","unstructured":"httparchive. 2023. The page weight report on httparchive. https:\/\/httparchive.org\/reports\/page-weight"},{"key":"e_1_3_2_1_20_1","unstructured":"Internet Archive. 2023. CDX digest not accurately capturing duplicates. https:\/\/archive.org\/post\/1009990\/cdx-digest-not-accurately-capturing-duplicates"},{"key":"e_1_3_2_1_21_1","unstructured":"Internet Archive. 2023. Internet Archive website. https:\/\/archive.org\/"},{"key":"e_1_3_2_1_22_1","volume-title":"2019 USENIX Annual Technical Conference (USENIX ATC 19)","author":"Jangda Abhinav","year":"2019","unstructured":"Abhinav Jangda, Bobby Powers, Emery D Berger, and Arjun Guha. 2019. Not so fast: Analyzing the performance of {WebAssembly} vs. native code. In 2019 USENIX Annual Technical Conference (USENIX ATC 19). 107\u2013120."},{"key":"e_1_3_2_1_23_1","volume-title":"2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2940\u20132955","author":"Johnson Evan","year":"2023","unstructured":"Evan Johnson, Evan Laufer, Zijie Zhao, Dan Gohman, Shravan Narayan, Stefan Savage, Deian Stefan, and Fraser Brown. 2023. WaVe: a verifiably secure WebAssembly sandboxing runtime. In 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2940\u20132955."},{"key":"e_1_3_2_1_24_1","volume-title":"2022 IEEE 15th International Conference on Cloud Computing (CLOUD). IEEE, 543\u2013553","author":"Kim Minseo","year":"2022","unstructured":"Minseo Kim, Hyerean Jang, and Youngjoo Shin. 2022. Avengers, assemble! Survey of WebAssembly security solutions. In 2022 IEEE 15th International Conference on Cloud Computing (CLOUD). IEEE, 543\u2013553."},{"key":"e_1_3_2_1_25_1","volume-title":"Proceedings of the 29th USENIX Conference on Security Symposium. 217\u2013234","author":"Lehmann Daniel","year":"2020","unstructured":"Daniel Lehmann, Johannes Kinder, and Michael Pradel. 2020. Everything old is new again: Binary security of webassembly. In Proceedings of the 29th USENIX Conference on Security Symposium. 217\u2013234."},{"key":"e_1_3_2_1_26_1","volume-title":"Fuzzing the Latest NTFS in Linux with Papora: An Empirical Study. arXiv preprint arXiv:2304.07166","author":"Lo Edward","year":"2023","unstructured":"Edward Lo, Ningyu He, Yuejie Shi, Jiajia Xu, Chiachih Wu, Ding Li, and Yao Guo. 2023. Fuzzing the Latest NTFS in Linux with Papora: An Empirical Study. arXiv preprint arXiv:2304.07166 (2023)."},{"key":"e_1_3_2_1_27_1","unstructured":"MDN. 2023. MDN web docs website. https:\/\/developer.mozilla.org\/en-US\/docs\/WebAssembly\/Rust_to_wasm"},{"key":"e_1_3_2_1_28_1","unstructured":"Jordon Mears. 2023. How we're bringing Google Earth to the web. https:\/\/web.dev\/case-studies\/earth-webassembly"},{"key":"e_1_3_2_1_29_1","unstructured":"medium. 2023. Cisco Umbrella Releases Free Top 1 Million Sites List. https:\/\/medium.com\/cisco-shifted\/cisco-umbrella-releases-free-top-1-million-sites-list-8497fba58efe"},{"key":"e_1_3_2_1_30_1","unstructured":"Microsoft. 2023. ASP.NET Core Blazor hosting models. https:\/\/learn.microsoft.com\/en-us\/aspnet\/core\/blazor\/hosting-models?view=aspnetcore-8.0"},{"key":"e_1_3_2_1_31_1","volume-title":"DIMVA 2019, Gothenburg, Sweden, June 19\u201320, 2019, Proceedings 16","author":"Musch Marius","year":"2019","unstructured":"Marius Musch, Christian Wressnegger, Martin Johns, and Konrad Rieck. 2019. New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild. In Detection of Intrusions and Malware, and Vulnerability Assessment: 16th International Conference, DIMVA 2019, Gothenburg, Sweden, June 19\u201320, 2019, Proceedings 16. Springer, 23\u201342."},{"key":"e_1_3_2_1_32_1","unstructured":"OpenAI. 2023. The models of OpenAI API. https:\/\/platform.openai.com\/docs\/models\/gpt-3-5"},{"key":"e_1_3_2_1_33_1","unstructured":"Addy Osmani. 2023. Photoshop is now on the web. https:\/\/medium.com\/@addyosmani\/photoshop-is-now-on-the-web-38d70954365a"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2431211.2431216","article-title":"Virtualization: Issues, security threats, and solutions","volume":"45","author":"Pearce Michael","year":"2013","unstructured":"Michael Pearce, Sherali Zeadally, and Ray Hunt. 2013. Virtualization: Issues, security threats, and solutions. ACM Computing Surveys (CSUR) 45, 2 (2013), 1\u201339.","journal-title":"ACM Computing Surveys (CSUR)"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"crossref","first-page":"729","DOI":"10.1007\/s13042-013-0166-4","article-title":"Virtual machine security challenges: case studies","volume":"5","author":"Rehman Amjad","year":"2014","unstructured":"Amjad Rehman, Sultan Alqahtani, Ayman Altameem, and Tanzila Saba. 2014. Virtual machine security challenges: case studies. International Journal of Machine Learning and Cybernetics 5 (2014), 729\u2013742.","journal-title":"International Journal of Machine Learning and Cybernetics"},{"key":"e_1_3_2_1_36_1","volume-title":"2021 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE). IEEE, 42\u201354","author":"Romano Alan","year":"2021","unstructured":"Alan Romano, Xinyue Liu, Yonghwi Kwon, and Weihang Wang. 2021. An empirical study of bugs in webassembly compilers. In 2021 36th IEEE\/ACM International Conference on Automated Software Engineering (ASE). IEEE, 42\u201354."},{"key":"e_1_3_2_1_37_1","unstructured":"statista. 2024. Number of unique phishing sites detected worldwide. https:\/\/www.statista.com\/statistics\/266155\/number-of-phishing-domain-names-worldwide\/"},{"key":"e_1_3_2_1_38_1","volume-title":"Proceedings of the 37th ACM\/SIGAPP Symposium on Applied Computing. 1713\u20131722","author":"Sti\u00e9venart Quentin","year":"2022","unstructured":"Quentin Sti\u00e9venart, Coen De Roover, and Mohammad Ghafari. 2022. Security risks of porting c programs to WebAssembly. In Proceedings of the 37th ACM\/SIGAPP Symposium on Applied Computing. 1713\u20131722."},{"key":"e_1_3_2_1_39_1","unstructured":"Samaneh Tajalizadehkhoob. 2019. The Tale of Website Popularity Rankings: An Extensive Analysis. https:\/\/labs.ripe.net\/author\/samaneh_tajalizadehkhoob_1\/the-tale-of-website-popularity-rankings-an-extensive-analysis\/"},{"key":"e_1_3_2_1_40_1","unstructured":"TinyGo. 2023. TinyGo official docs webpage. https:\/\/tinygo.org\/docs\/guides\/webassembly\/"},{"key":"e_1_3_2_1_41_1","unstructured":"Troy Hunt. 2023. Here's How I'm Fighting Cryptojacking and Doing Good Things with Content Security Policies. https:\/\/www.troyhunt.com\/i-now-own-the-coinhive-domain-heres-how-im-fighting-cryptojacking-and-doing-good-things-with-content-security-policies\/"},{"key":"e_1_3_2_1_42_1","unstructured":"urlscan. 2023. urlscan official website. https:\/\/urlscan.io\/"},{"key":"e_1_3_2_1_43_1","unstructured":"urlscan. 2023. The user verdicts and comments section of urlscan. https:\/\/urlscan.io\/blog\/2022\/02\/10\/user-verdicts\/"},{"key":"e_1_3_2_1_44_1","unstructured":"wabt. 2023. wabt tool website. https:\/\/github.com\/WebAssembly\/wabt"},{"key":"e_1_3_2_1_45_1","unstructured":"wabt. 2023. wasm2wat tool website. https:\/\/webassembly.github.io\/wabt\/doc\/wasm2wat.1.html"},{"key":"e_1_3_2_1_46_1","volume-title":"2023 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER). IEEE, 355\u2013366","author":"Wang Yue","year":"2023","unstructured":"Yue Wang, Zhide Zhou, Zhilei Ren, Dong Liu, and He Jiang. 2023. A Comprehensive Study of WebAssembly Runtime Bugs. In 2023 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER). IEEE, 355\u2013366."},{"key":"e_1_3_2_1_47_1","unstructured":"WebAssembly. 2023. The APIs of WASI. https:\/\/github.com\/WebAssembly\/WASI\/blob\/main\/legacy\/preview1\/docs.md"},{"key":"e_1_3_2_1_48_1","unstructured":"WebAssembly. 2023. The binary format of WebAssembly. https:\/\/webassembly.github.io\/spec\/core\/binary\/modules.html#binary-module"},{"key":"e_1_3_2_1_49_1","unstructured":"WebAssembly. 2023. The dynamic linking of WebAssembly. https:\/\/www.wasm.com.cn\/docs\/dynamic-linking\/"},{"key":"e_1_3_2_1_50_1","unstructured":"WebAssembly. 2023. Github WASI repository. https:\/\/github.com\/WebAssembly\/WASI"},{"key":"e_1_3_2_1_51_1","unstructured":"WebAssembly. 2023. Github wasi-sdk repository. https:\/\/github.com\/WebAssembly\/wasi-sdk"},{"key":"e_1_3_2_1_52_1","unstructured":"WebAssembly. 2023. The security design of WebAssembly. https:\/\/github.com\/WebAssembly\/design\/blob\/main\/Security.md"},{"key":"e_1_3_2_1_53_1","unstructured":"WebAssembly. 2023. WebAssembly official website. https:\/\/webassembly.org\/getting-started\/developers-guide\/"},{"key":"e_1_3_2_1_54_1","unstructured":"wiki. 2023. Address space layout randomization. https:\/\/en.wikipedia.org\/wiki\/Address_space_layout_randomization"},{"key":"e_1_3_2_1_55_1","unstructured":"wiki. 2023. Buffer overflow protection. https:\/\/en.wikipedia.org\/wiki\/Buffer_overflow_protection#Canaries"},{"key":"e_1_3_2_1_56_1","unstructured":"wiki. 2023. Cross-site scripting. https:\/\/en.wikipedia.org\/wiki\/Cross-site_scripting"},{"key":"e_1_3_2_1_57_1","unstructured":"wiki. 2023. Name mangling. https:\/\/en.wikipedia.org\/wiki\/Name_mangling"},{"key":"e_1_3_2_1_58_1","volume-title":"5th International conference on computer sciences and convergence information technology. IEEE, 18\u201321","author":"Wu Hanqian","year":"2010","unstructured":"Hanqian Wu, Yi Ding, Chuck Winer, and Li Yao. 2010. Network security for virtual machine in cloud computing. In 5th International conference on computer sciences and convergence information technology. IEEE, 18\u201321."},{"key":"e_1_3_2_1_59_1","unstructured":"XMRIG. 2023. Github xmrig repository. https:\/\/github.com\/xmrig\/xmrig"},{"key":"e_1_3_2_1_60_1","volume-title":"Proceedings of the 21st ACM Internet Measurement Conference. 533\u2013549","author":"Yan Yutian","year":"2021","unstructured":"Yutian Yan, Tengfei Tu, Lijian Zhao, Yuchen Zhou, and Weihang Wang. 2021. Understanding the performance of webassembly applications. In Proceedings of the 21st ACM Internet Measurement Conference. 533\u2013549."},{"key":"e_1_3_2_1_61_1","volume-title":"Characterizing and Detecting WebAssembly Runtime Bugs. arXiv preprint arXiv:2301.12102","author":"Zhang Yixuan","year":"2023","unstructured":"Yixuan Zhang, Shangtong Cao, Haoyu Wang, Zhenpeng Chen, Xiapu Luo, Dongliang Mu, Yun Ma, Gang Huang, and Xuanzhe Liu. 2023. Characterizing and Detecting WebAssembly Runtime Bugs. arXiv preprint arXiv:2301.12102 (2023)."}],"event":{"name":"FSE Companion '25: 33rd ACM International Conference on the Foundations of Software Engineering","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"],"location":"Clarion Hotel Trondheim Trondheim Norway","acronym":"FSE Companion '25"},"container-title":["Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3696630.3728570","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,28]],"date-time":"2025-07-28T19:15:41Z","timestamp":1753730141000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3696630.3728570"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,23]]},"references-count":61,"alternative-id":["10.1145\/3696630.3728570","10.1145\/3696630"],"URL":"https:\/\/doi.org\/10.1145\/3696630.3728570","relation":{},"subject":[],"published":{"date-parts":[[2025,6,23]]},"assertion":[{"value":"2025-07-28","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}