Collected research

Code-Injection Attacks in Browsers Supporting Policies (return-to-JavaScript)

Elias Athanasopoulos, Vasilis Pappas and Evangelos P. Markatos · ieee-security.org

A W2SP 2009 paper on XSS attacks that defeat browser-enforced policy frameworks. It examines BEEP, which whitelists trusted scripts in the browser, and shows attacks analogous to return-to-libc that reuse already-trusted client-side code rather than injecting new script. It proposes isolating trusted code via policies expressed as browser actions.

Record

Researcher

Elias Athanasopoulos, Vasilis Pappas and Evangelos P. Markatos

Published by

ieee-security.org

Format

Whitepaper

Topic

Injection

In the archive

• Collected in the 2009 research round

Tags

• xss
• csp
• javascript
• filter-bypass
• formal-analysis
• mitigation
• defence
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Elias Athanasopoulos, Vasilis Pappas and Evangelos P. Markatos, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.