Collected research

On the Incoherencies in Web Browser Access Control Policies

Kapil Singh, Alexander Moshchuk, Helen J. Wang and Wenke Lee · Microsoft Research

Browsers label principals differently for DOM, cookies, XHR and display, so their policies conflict wherever those resources interplay, and runtime document.domain changes are ignored by most of them. User-owned resources such as clipboard and geolocation are reachable from scripts. WebAnalyzer, an instrumented IE crawler, measured each unsafe feature across the Alexa top 100,000.

Record

Researcher

Kapil Singh, Alexander Moshchuk, Helen J. Wang and Wenke Lee

Published by

Microsoft Research

Topic

Browser

In the archive

• Collected in the 2010 research round

Tags

• same-origin-policy
• sop-bypass
• cookie
• dom
• measurement-study
• large-scale-scan
• info-leak
• clickjacking
• owasp-a01-2021
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Kapil Singh, Alexander Moshchuk, Helen J. Wang and Wenke Lee, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.