Collected research

The Leaky Web: Automated Discovery of Cross-Site Information Leaks in Browsers and the Web

Jannis Rautenstrauch, Giancarlo Pellegrino and Ben Stock · trouge.net

An automated framework drives Chromium, Firefox and WebKit over a large space of crafted HTTP responses and browser APIs, summarising the results as decision trees, and finds 280 cross-site observation channels plus 11 browser bugs. Its scanning pipeline then shows 15% of top sites leak past visits, 34% leak cookie-banner acceptance and 77 of 100 leak login state.

Record

Researcher

Jannis Rautenstrauch, Giancarlo Pellegrino and Ben Stock

Published by

trouge.net

Format

Whitepaper

Topic

Browser

In the archive

• Collected in the 2023 research round

Related sources

• The Leaky Web: Automated Discovery of Cross-Site Information Leaks in Browsers and the Web

Tags

• xsleak
• side-channel
• info-leak
• same-origin-policy
• cookie
• iframe
• measurement-study
• large-scale-scan
• tooling
• cve
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Jannis Rautenstrauch, Giancarlo Pellegrino and Ben Stock, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.