  The complexity of browsers has steadily increased over the years, driven by
the continuous introduction and update of Web platform components, such as
novel Web APIs and security mechanisms. Their specifications are manually
reviewed by experts to identify potential security issues. However, this
process has proved to be error-prone due to the extensiveness of modern browser
specifications and the interplay between new and existing Web platform
components. To tackle this problem, we developed WebSpec, the first formal
security framework for the analysis of browser security mechanisms, which
enables both the automatic discovery of logical flaws and the development of
machine-checked security proofs. WebSpec, in particular, includes a
comprehensive semantic model of the browser in the Coq proof assistant, a
formalization in this model of ten Web security invariants, and a toolchain
turning the Coq model and the Web invariants into SMT-lib formulas to enable
model checking with the Z3 theorem prover. If a violation is found, the
toolchain automatically generates executable tests corresponding to the
discovered attack trace, which is validated across major browsers. We showcase
the effectiveness of WebSpec by discovering two new logical flaws caused by the
interaction of different browser mechanisms and by identifying three previously
discovered logical flaws in the current Web platform, as well as five in old
versions. Finally, we show how WebSpec can aid the verification of our proposed
changes to amend the reported inconsistencies affecting the current Web
platform.
