Collected research

Finding All Cross-Site Needles in the DOM Stack

Finding All Cross-Site Needles in the DOM Stack: A Comprehensive Methodology for the Automatic XS-Leak Detection in Web Browsers

Jörg Schwenk, Marcus Niemietz, Christian Mainka, Lukas Knittel and Dominik Trevor Noß · CASA - Cyber Security in the Age of Large-Scale Adversaries

AutoLeak turns a page's runtime DOM into a directed graph in each of two user states and diffs the two graphs, enumerating every property and object a cross-origin attacker can observe. Across 151,776 generated test cases in Chrome, Firefox and Safari it found up to 8,403 leak techniques per case, five new XS-Leak classes that detect HTTP response headers cross-site, and leaks on 20 of 24 top sites tested.

Record

Document

Finding All Cross-Site Needles in the DOM Stack: A Comprehensive Methodology for the Automatic XS-Leak Detection in Web Browsers

Researcher

Jörg Schwenk, Marcus Niemietz, Christian Mainka, Lukas Knittel and Dominik Trevor Noß

Published by

CASA - Cyber Security in the Age of Large-Scale Adversaries

Topic

Browser

In the archive

• Collected in the 2023 research round

Tags

• xsleak
• side-channel
• info-leak
• dom
• same-origin-policy
• http
• tooling
• large-scale-scan
• measurement-study
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Jörg Schwenk, Marcus Niemietz, Christian Mainka, Lukas Knittel and Dominik Trevor Noß, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.