VisibleV8

Overview

strace for the web

VisibleV8 (VV8) is a custom variant of the V8 JavaScript engine at the heart of the Chromium browser, the Node.js application runtime, and probably other titans of the modern software world. Maintained and distributed as a minimally-invasive and maintainable patchset, VV8 captures and logs the following activities in plaintext logs:

All JS function calls that cross the JS/hosting-application boundary (i.e., calls to what V8 internally dubs “API” functions, like window.alert in a browser)
Named (e.g., foo.bar) or keyed (e.g., foo["bar"]) property lookups for which the receiver (e.g., foo) refers to an object defined by the hosting application or the global object
Assignments to named or keyed property expressions involving receiver objects defined by the hosting application (or the global object)
Reflect.get and Reflect.set API access to properties on hosting application-defined objects

Log records directly or indirectly include the following context:

Source code of the immediately active/invoking script
Simple provenance details of active script (i.e., source URL or eval-ing script)
Character offset of function call/property access within active script
Receiver type information (i.e., constructor/prototype function name)
Property/function name
Value (for primitive values) or type information (for objects) passed to function calls as arguments or as the new property value for property assignments

Papers

Cross-Boundary Mobile Tracking: Exploring Java-to-JavaScript Information Diffusion in WebViews
Sohom Datta, Michalis Diamantaris, Ahsan Zafar, Junhua Su, Anupam Das, Jason Polakis, Alexandros Kapravelos
Proceedings of the Network and Distributed System Security Symposium (NDSS), 2026
[PDF] [code]

@inproceedings{vv8webview-ndss26,
  title = {{Cross-Boundary Mobile Tracking: Exploring Java-to-JavaScript Information Diffusion in WebViews}},
  author = {Datta, Sohom and Diamantaris, Michalis and Zafar, Ahsan and Su, Junhua and Das, Anupam and Polakis, Jason and Kapravelos, Alexandros},
  booktitle = {{Proceedings of the Network and Distributed System Security Symposium (NDSS)}},
  month = feb,
  code = {{https://github.com/wspr-ncsu/webviewtracer}},
  tag = {vv8},
  year = {2026}
}

Same Script, Different Behavior: Characterizing Divergent JavaScript Execution Across Different Device Platforms
Ahsan Zafar, Junhua Su, Sohom Datta, Alexandros Kapravelos, Anupam Das
Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2025
[PDF] [DOI]

@inproceedings{vv8diverge-ccs25,
  title = {{Same Script, Different Behavior: Characterizing Divergent JavaScript Execution Across Different Device Platforms}},
  author = {Zafar, Ahsan and Su, Junhua and Datta, Sohom and Kapravelos, Alexandros and Das, Anupam},
  booktitle = {{Proceedings of the ACM Conference on Computer and Communications Security (CCS)}},
  month = oct,
  pages = {1889--1903},
  doi = {10.1145/3719027.3765202},
  tag = {vv8},
  year = {2025}
}

FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques
Nikolaos Pantelaios, Alexandros Kapravelos
Proceedings of the USENIX Security Symposium, 2024
[PDF] [code]

@inproceedings{fv8-sec24,
  title = {{FV8: A Forced Execution JavaScript Engine for Detecting Evasive Techniques}},
  author = {Pantelaios, Nikolaos and Kapravelos, Alexandros},
  booktitle = {{Proceedings of the USENIX Security Symposium}},
  code = {{https://github.com/wspr-ncsu/FV8}},
  month = aug,
  pages = {3747--3764},
  tag = {vv8},
  year = {2024}
}

Automatic Discovery of Emerging Browser Fingerprinting Techniques
Junhua Su, Alexandros Kapravelos
Proceedings of The Web Conference (WWW), 2023
[PDF] [code]

@inproceedings{fptechniques-www23,
  title = {{Automatic Discovery of Emerging Browser Fingerprinting Techniques}},
  author = {Su, Junhua and Kapravelos, Alexandros},
  booktitle = {{Proceedings of The Web Conference (WWW)}},
  month = apr,
  code = {{https://github.com/wspr-ncsu/BrowserFingerprintingAD}},
  pages = {2178--2188},
  tag = {vv8},
  year = {2023}
}

Browserprint: An Analysis of the Impact of Browser Features on Fingerprintability and Web Privacy
Seyed Ali Akhavani, Jordan Jueckstock, Junhua Su, Alexandros Kapravelos, Engin Kirda, Long Lu
Proceedings of the Information Security Conference (ISC), 2021
[PDF]

@inproceedings{browserprint-isc21,
  title = {{Browserprint: An Analysis of the Impact of Browser Features on Fingerprintability and Web Privacy}},
  author = {Akhavani, Seyed Ali and Jueckstock, Jordan and Su, Junhua and Kapravelos, Alexandros and Kirda, Engin and Lu, Long},
  booktitle = {{Proceedings of the Information Security Conference (ISC)}},
  pages = {161--176},
  month = nov,
  tag = {vv8},
  year = {2021}
}

Towards Realistic and Reproducible Web Crawl Measurements
Jordan Jueckstock, Shaown Sarker, Peter Snyder, Aidan Beggs, Panagiotis Papadopoulos, Matteo Varvello, Ben Livshits, Alexandros Kapravelos
Proceedings of The Web Conference (WWW), 2021
[PDF] [code]

@inproceedings{vpc-www21,
  title = {{Towards Realistic and Reproducible Web Crawl Measurements}},
  author = {Jueckstock, Jordan and Sarker, Shaown and Snyder, Peter and Beggs, Aidan and Papadopoulos, Panagiotis and Varvello, Matteo and Livshits, Ben and Kapravelos, Alexandros},
  booktitle = {{Proceedings of The Web Conference (WWW)}},
  code = {{https://github.com/wspr-ncsu/reprocrawl-code-release}},
  pages = {80–91},
  numpages = {13},
  month = apr,
  tag = {vv8},
  year = {2021}
}

Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage
Shaown Sarker, Jordan Jueckstock, Alexandros Kapravelos
Proceedings of the ACM Internet Measurement Conference (IMC), 2020
[PDF]

@inproceedings{jsobf-imc20,
  title = {{Hiding in Plain Site: Detecting JavaScript Obfuscation through Concealed Browser API Usage}},
  author = {Sarker, Shaown and Jueckstock, Jordan and Kapravelos, Alexandros},
  booktitle = {{Proceedings of the ACM Internet Measurement Conference (IMC)}},
  pages = {648–661},
  month = oct,
  tag = {vv8},
  year = {2020}
}

VisibleV8: In-browser Monitoring of JavaScript in the Wild
Jordan Jueckstock, Alexandros Kapravelos
Proceedings of the ACM Internet Measurement Conference (IMC), 2019
[PDF] [website] [slides] [talk] [code]

@inproceedings{vv8-imc19,
  title = {{VisibleV8: In-browser Monitoring of JavaScript in the Wild}},
  author = {Jueckstock, Jordan and Kapravelos, Alexandros},
  booktitle = {{Proceedings of the ACM Internet Measurement Conference (IMC)}},
  pages = {393–405},
  month = oct,
  howpublished = {/projects/vv8/},
  code = {{https://github.com/wspr-ncsu/visiblev8}},
  slides = {/presentations/vv8-imc19.pdf},
  talk = {https://vimeo.com/showcase/6531379/video/369121825#t=3500s},
  tag = {vv8},
  year = {2019}
}

Availability

The VV8 patches, tests, build scripts, and documentation are all available on GitHub.