Back to the list

Ecma TC39 new Task Group dedicated to the security of the ECMAScript (JavaScript) language


Geneva, 27 July 2021

During the July 2021 TC39 meeting, TC39 added a new Task Group dedicated to the security of the ECMAScript® Language, formally named TC39-TG3. The scope of this TC39-TG3 is to ensure the ECMAScript security model is effective for the constantly evolving threat landscape of today and tomorrow. The programme of work is as follows:

  1. To assess the security impacts of proposals to TC39.
  2. To produce documentation on the ECMAScript security model.
  3. To introduce proposals that will help developers create secure programs.
  4. To recommend a committee response to privately disclosed security issues.
  5. To maintain best practices or recommendations for writing secure programs.
  6. To monitor the changing threat landscape for popular embeddings.

To lead this critical Task Group, members of TC39 elected Granville Schmidt, from the Office of the CTO at F5, as the Convenor. Granville is an experienced security and engineering practitioner with a passion for keeping sensitive data safe and out of malicious actors’ hands. Below is what Granville had to say about his new role:

“I am beyond excited for my new role as Convenor of TC39-TG3. The opportunity to work with member organizations and the broader community to ensure the continual effectiveness of the ECMAScript security model, is a truly a dream come true. ECMAScript has become one of the furthest reaching programming languages to date. Not only does it power websites, but it has also become one of the top programming languages used for mobile apps, IoT, edge computing, and server-side applications. Given this tremendous reach, significant care must be taken to ensure ECMAScript provides the secure foundation organizations require to build their mission critical applications with.” – Granville Schmidt


Office of the CTO at F5, Inc.



The following are the current member organizations who have committed to participating in this new Task Group:

  • Agoric
  • Alibaba
  • ConsenSys
  • F5
  • GoDaddy
  • Google
  • Igalia
  • MetaMask
  • Moddable
  • Mozilla
  • Salesforce
  • Sujitech

Additional links:

  • TC39 – ECMAScript
    • TC39-TG1 – General ECMAScript® Language
    • TC39-TG2 – ECMAScript® Internationalization API Specification
    • TC39-TG3 – Security

ECMAScript® is the registered trademark of Ecma International.

JavaScriptTM is the trademark of Oracle.

For more information: please contact Patrick Luthi, Secretary General of Ecma International at