Collected research

Information Leaks via Safari’s Intelligent Tracking Prevention

Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum and Roberto Clapis · Google

Safari’s user-specific tracking-prevention list creates global state that websites can alter and probe. Overlong Referer headers and other request side channels reveal domain classification, enabling browsing-history inference, persistent identifiers and cross-site search leaks. Attackers can also force domains onto the list to disrupt authenticated requests.

Record

Researcher

Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum and Roberto Clapis

Published by

Google

Topic

Browser

In the archive

• Collected in the 2020 research round

Tags

• xsleak
• side-channel
• browser-fingerprinting
• info-leak
• cookie
• http
• abuse-of-functionality
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum and Roberto Clapis, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.