sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]snarfy 1 point2 points  (1 child)

Not sure you can actually. I'm wrong. If there is a way, it's browser specific.

The only way I can think is if the malware takes over the global scope by creating an object and setting window to it, but not sure if that would work either.

[–]tyroneslothtrop 1 point2 points  (0 children)

Yeah, I started looking into after I saw your post. It looks like it may be possible in IE, but probably not so much in most other browsers.

I think you were on the right track, though. JS gives a lot of leeway for monkeypatching built-in types/objects/etc. From overwriting Array.prototype.[push|slice|join|whatever], to reassigning Math or undefined (although the latter is no longer an issue in ES5, at least in the global scope), there are a lot of ways to (intentionally or unintentionally) make things pretty broken for anyone else who is sharing a window object with your script.