3 ms·
If the js engine has no bugs it cannot do anything harmful, but since this is Avast's own custom engine it likely has security bugs which allow malicious JS cod
by jeltz 7y ago
If the js engine has no bugs it cannot do anything harmful, but since this is Avast's own custom engine it likely has security bugs which allow malicious JS code to escape the engine, and if it does it can do virtually anything with your machine since the engine runs as SYSTEM.
Writing your own JS engine and then running it as SYSTEM is terrible engineering and very dangerous. There is no reason for why they have to run it as SYSTEM.
- tgtweak 7y agoHas anyone confirmed it is their own? I'd be surprised if it wasn't a shaved-down v8 or similar. Lastly have we confirmed there's no memory or thread protection in place? Most AV reputable AV companies have strong proprietary sandbox code (especially in the scan engine process) which is on par with virtualization in terms of isolation.
- saagarjha 7y agoIt doesn't look like V8.