Mozilla WAICT Verifies Web App JavaScript in Nightly
WAICT in Firefox Nightly binds client code to public manifests so browsers reject unlogged JavaScript. This stops compromised servers from silently injecting malicious code into encrypted web apps like Signal. Test it at waict.dev.
Why it matters
Browser-based end-to-end encrypted applications like Signal and WhatsApp currently trust the server to deliver honest JavaScript. A compromised or malicious server can selectively serve modified code to specific users, silently exfiltrating cryptographic keys or messages without triggering any client-side alarm. This breaks the core promise of end-to-end encryption because the server remains inside the trust boundary for code delivery. For any engineer building sensitive web applications, this is a fundamental supply-chain vulnerability that no amount of TLS or CSP can fully close. Even with Subresource Integrity, the root HTML and bootstrap scripts are still trusted, leaving a gap that nation-state attackers or insider threats can exploit.
What changed
Mozilla has introduced Web Application Integrity, Consistency and Transparency (WAICT), a new platform primitive now prototyped behind a preference in Firefox Nightly. WAICT lets developers cryptographically bind their client-side code to a manifest and commit that manifest to a publicly auditable transparency log. When a user visits an opted-in site, the browser verifies that the delivered JavaScript matches a manifest in the public log before execution. If the code has not been logged, the browser rejects it. Mozilla is developing the specification openly and collaborating with Cloudflare, Meta, and the Freedom of the Press Foundation to refine the deployment model. An early demo, including an end-to-end encrypted video calling application secured by WAICT, is live at waict.dev for testing and feedback.
What to watch
WAICT is explicitly labeled as a work in progress, not a finished standard. Engineers should evaluate the prototype for compatibility with existing build pipelines and consider how manifest signing fits into their release workflows. The success of the standard will depend on browser vendor adoption beyond Mozilla and on the operational robustness of the transparency logs. Watch for standardization activity in web platform groups and for Cloudflare and Meta to publish integration patterns for their infrastructure. If WAICT gains traction, it could become a baseline requirement for regulated web applications handling health or financial data.
Interview question
Which scenario best describes the supply-chain vulnerability WAICT is designed to prevent in encrypted web apps?
- a.A compromised server selectively serves modified JavaScript to specific users to exfiltrate keysCorrect
- b.A developer publishes a broken build that accidentally leaks plaintext messages
- c.An attacker intercepts network traffic and replaces JavaScript en route to the user
- d.A browser extension injects malicious code after the page has finished loading
Why? this is the answer
The card explains that WAICT stops compromised servers from silently injecting malicious JavaScript to specific users, which breaks end-to-end encryption. Option C describes a man-in-the-middle attack that TLS already prevents, whereas WAICT closes the trust gap that TLS and SRI leave open.
Just read this? Test yourself on what you have been reading.
Read the original → hacks.mozilla.org
- #waict
- #firefox
- #security
- #web-platform
- #e2ee
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles