Prisma Browser
Advanced Browser Protection
Table of Contents
Expand All
|
Collapse All
Prisma Browser Docs
Advanced Browser Protection
Advanced Browser Protection
| Where Can I Use This? | What Do I Need? |
|---|---|
|
|
|
Advanced Browser Protection (WASM Guard) is a proactive security control within
the Prisma Browser hardening suite. It protects endpoints from zero-day
vulnerabilities and memory-resident exploits that abuse WebAssembly (WASM) to achieve
remote code execution (RCE).
This control operates at the browser memory layer to stop exploitation attempts
before attackers can escape the browser sandbox or escalate privileges to the operating
system.
Overview
WebAssembly (WASM) is a high-performance binary instruction format that
modern browsers use to execute complex, compute-intensive applications. While WASM
improves performance, attackers increasingly use it as a delivery mechanism for
sophisticated browser-based exploits.
WASM Guard monitors the browser’s memory translation layer and enforces
strict memory access boundaries. When a process attempts to write outside its
permitted memory scope, WASM Guard immediately blocks the action, preventing the
exploit from progressing.
Background
Modern browser attacks typically begin with malicious JavaScript that
triggers a memory corruption vulnerability. Attackers then use WASM’s in-memory
table structures to write to unauthorized memory addresses and gain execution
rights.
WASM Guard functions as a validator at the memory translation layer.
Similar to how a DNS resolver maps names to IP addresses, WASM Guard verifies that
each memory access request maps to an approved address range. If a process attempts
to access memory outside its allowed scope, WASM Guard immediately terminates the
action.
This follows MITRE ATT&CK T1203 - Exploitation for Client Execution
Configuring Advanced Browser Protection
For information regarding configuration, refer to Configure Browser Hardening.
Monitoring and Incident Response
When WASM Guard intercepts an exploit attempt, Prisma Browser generates a
Tampering Event and displays it in the Security Dashboard.
Security teams can review
the following fields to investigate the incident:
- Event Type: RCE exploit attempt.
- Detection sensor: WASM Guard.
- Exploited URL: URL hosting the malicious WASM or JavaScript content.
- User/Device: User identity and endpoint where the block occurred.
Response and Remediation
Because WASM Guard stops the exploit at the point of execution, endpoints
typically require no additional remediation.
However, administrators should take the following actions:
- Block the exploited URL at the network or security policy level.
- Investigate the traffic source to identify potential compromise attempts or broader campaigns.
- Review related security events to confirm that no lateral activity occurred.