Later archive addition

Side-Channel Attacking Browsers through CSS3 Features

The researchers show that CSS mix-blend-mode can act as a visual side channel against cross-origin iframes. Their proof of concept recovers pixel information and uses it to identify logged-in Facebook users without interaction, demonstrating a practical same-origin-policy leak in Chrome and Firefox.

In the archive

• Added to the 2018 archive after the original list was published

Tags

• css
• side-channel
• same-origin-policy
• deanonymization
• iframe
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.