Collected research

Cross-Site Search Attacks

Nethanel Gelernter and Amir Herzberg · dl.acm.org

Cross-site search attacks time the responses to search queries a rogue page sends to a service the victim is logged into, inferring private data without breaking the same-origin policy. Statistical tests, inflating the response or the server work, and tailored divide-and-conquer term search made the channel practical against Gmail and Bing.

Record

Researcher

Nethanel Gelernter and Amir Herzberg

Published by

dl.acm.org

Topic

Other

In the archive

• Collected in the 2015 research round

Related sources

• Timing Attacks Have Never Been So Practical: Advanced Cross-Site Search Attacks

Tags

• xsleak
• timing-attack
• side-channel
• info-leak
• same-origin-policy
• csrf
• http
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Nethanel Gelernter and Amir Herzberg, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.