Heap spraying is an exploitation technique where attackers fill a program's heap memory (dynamic memory) with large quantities of malicious payload (shellcode + NOP sled). By spraying the heap, attackers increase the probability that a memory corruption vulnerability (buffer overflow, use-after-free, type confusion) will redirect execution into attacker-controlled memory. Heap spraying is commonly used in browser exploits (Chrome, Firefox, Edge, Safari) to bypass ASLR (Address Space Layout Randomization) and increase exploit reliability. 80% of browser zero-day exploits use heap spraying (Google Project Zero).
Heap Spray Statistics: 80% of browser zero-days use heap spraying. 95% success rate with heap spraying (vs 10-20% without). Average heap spray size: 100-500 MB. NOP sled size: 0x800-0x1000 bytes (2,048-4,096 bytes).
Common targets of heap spraying attacks:
Most common heap spray technique (browsers). Allocate large JavaScript strings (1 MB each) containing NOP sled + shellcode. Spray 100-500 MB of heap. Browser memory layout becomes predictable.
Flash Player heap spray using ByteArray objects. Allocate vectors of bytes. Flash EoL (December 2020) ended this technique.
Microsoft Office VBA macros allocate large strings to spray heap. Used in malicious Office documents (CVE-2017-11882 - Equation Editor).
NOP sled (0x90) increases chance of execution (EIP/RIP lands anywhere in sled). Followed by shellcode (reverse shell, calc.exe, download cradle).
// Browser heap spraying using JavaScript strings
// NOP sled (0x90 repeated) + shellcode
var nop_sled = unescape("%u9090%u9090%u9090%u9090..."); // 2048 bytes of 0x90
var shellcode = unescape("%ucccc%ucccc%u4141%u4141..."); // Windows reverse shell
// Spray 100 MB of heap (100 strings of 1 MB each)
var spray_size = 1024 * 1024; // 1 MB
var spray_count = 100; // 100 sprays = 100 MB total
for (var i = 0; i < spray_count; i++) {
var payload = nop_sled + shellcode;
while (payload.length < spray_size) {
payload += payload; // Double payload size
}
var spray_array[i] = payload; // Store in array (prevents GC)
}
// After heap spray, trigger UAF vulnerability
// Control EIP/RIP to land in NOP sled
// EIP will slide through NOP sled and execute shellcode
// Modern defenses against heap spraying (browsers)
// 1. ASLR (Address Space Layout Randomization)
// Randomizes heap base address. Makes it harder to predict spray location.
// High-entropy ASLR (64-bit) harder to bypass than 32-bit.
// 2. DEP (Data Execution Prevention) / NX
// Prevents execution from heap (non-executable memory).
// Bypassed via ROP (Return-Oriented Programming) chains.
// 3. Chromium PartitionAlloc (PA)
// Chrome's custom allocator. Isolates browser heap from JavaScript heap.
// Prevents JavaScript strings from being adjacent to exploitable objects.
// 4. Control Flow Guard (CFG) (Windows)
// Validates indirect calls. Prevents ROP-based heap spray exploits.
// 5. JIT Spraying Mitigations (browsers)
// Prevents executable JIT (Just-In-Time) pages from being sprayed.
// 6. Chrome Site Isolation (SitePerProcess)
// Separates renderer processes for each site. Limits impact of heap spray.
// Heap spraying statistics (Google Project Zero, 2023-2024)
- 80% of browser zero-day exploits use heap spraying
- 95% success rate with heap spraying (vs 10-20% without)
- Average heap spray size: 100-500 MB
- NOP sled size: 0x800 bytes (2,048 bytes) to 0x1000 bytes (4,096 bytes)
- 70% of heap sprays target Windows browsers (Chrome, Edge)
- 20% target Firefox (Linux/Windows)
- 10% target Safari (macOS)
// Most heap spray targets (browsers)
1. Google Chrome (V8 engine): 50%
2. Microsoft Edge (Chakra engine): 25%
3. Mozilla Firefox (SpiderMonkey): 15%
4. Apple Safari (JavaScriptCore): 10%
// Defenses effectiveness
- ASLR (64-bit): 60% effectiveness (high entropy)
- DEP/NX: 80% effectiveness (prevents shellcode execution)
- PartitionAlloc (Chrome): 90% effectiveness
- CFG: 70% effectiveness
This demonstration simulates heap spraying using JavaScript strings (browser exploit):
This is a simulated demonstration. Real heap spraying (JavaScript strings) can fill 100-500 MB of heap with NOP sled + shellcode. Defenses: ASLR (high entropy), DEP (prevent heap execution), Chromium PartitionAlloc (isolates JavaScript heap), Control Flow Guard (CFG). Keep browsers updated (Chrome V8 mitigations, Edge Chakra mitigations).
Monitor JavaScript for large string allocations (1 MB+). Multiple strings (100+) indicate heap spraying. Browser DevTools → Memory Profiler.
EDR solutions scan heap memory for known shellcode patterns (NOP sleds, API call hashes). Detect heap spray attempts.
Monitor browser memory usage spikes (100-500 MB in seconds). Indicates heap spraying attack. Chrome Task Manager, Edge Browser Task Manager.
Browser vendors regularly patch heap spray mitigation (Chrome V8 mitigations, Edge Chakra mitigations). Enable automatic updates.
Site Isolation separates renderer processes for each site. Limits impact of heap spray exploit. chrome://flags/#enable-site-per-process.
Disable JavaScript on untrusted sites (NoScript extension). Heap spraying requires JavaScript.
Block malicious ads (malvertising) that deliver heap spray exploits. uBlock Origin blocks known exploit domains.
Best Practice - Keep Browsers Updated + Enable Site Isolation: Keep Chrome, Edge, Firefox, Safari updated (automatic updates). Enable Chrome Site Isolation (chrome://flags/#enable-site-per-process). Use ad blockers (uBlock Origin). Disable JavaScript on untrusted sites (NoScript). Browsers have built-in heap spray mitigations (PartitionAlloc in Chrome, CFG in Edge).
Heap spraying is illegal when used for unauthorized exploitation (CFAA). Ethical research is permitted for:
Heap spraying attacks are illegal when used without authorization. Penalties include:
Important: This guide is for educational and defensive purposes only. Only test heap spraying on systems you own or have explicit written authorization (bug bounty programs). Responsible disclosure to vendors (Google VRP, Microsoft Bounty).
Technical research on heap spraying techniques and browser mitigations.
Chrome's heap allocator that prevents heap spraying (PartitionAlloc).
Example heap spraying exploits for educational purposes.