TechPrufer
Get started
Meta
Meta logoMeta · Feature trail

Hermes JavaScript Engine Security Exploitation

2 posts · Jul 2019 – Jul 2022

What this trail covers

Meta's Hermes JavaScript engine, optimized for mobile apps and React Native, has seen advancements in performance, download size, and memory utilization. Key architectural decisions include bytecode precompilation for faster startup, the absence of a JIT compiler to avoid performance regressions on primary metrics, and a garbage collector strategy focused on efficient memory and VA space usage. The engine supports ES6 and aims for standards compliance, with debugging capabilities via the Chrome DevTools protocol. JSI facilitates integration with React Native's Fabric and TurboModules. Future work includes profiling tools and broader debugger protocol support.

All Meta trails
  1. Using Hermes’s Quicksort to run Doom: A tale of JavaScript exploitationThis post details a specific vulnerability in Hermes's Quicksort implementation that leads to out-of-bounds memory reads. It explains how this vulnerability can be exploited to achieve arbitrary code execution by manipulating the sorting algorithm's behavior, including underflowing an index to enable controlled writes. The post also demonstrates the exploit by running Doom within Hermes, showcasing the severity of the bug.
  2. Hermes: An open source JavaScript engine optimized for mobile apps, starting with React NativeThis post introduces Hermes, a new JavaScript engine designed from scratch for mobile applications, specifically React Native. It details architectural decisions like bytecode precompilation (ahead-of-time compilation as part of the build process) to improve startup performance and reduce download size, the deliberate exclusion of a JIT compiler to avoid regressions in key mobile metrics (TTI, download size, memory utilization), and a garbage collector strategy optimized for mobile constraints (on-demand, noncontiguous, moving, generational). It also highlights lazy compilation for debug builds to maintain iteration speed and standards compliance (ES6, excluding proxies and local eval). Debugging support via Chrome DevTools protocol is also detailed. The post mentions JSI as an API enabling integration with React Native's Fabric and TurboModules.