Collected research

Mystique: Uncovering Information Leakage from Browser Extensions

Quan Chen and Alexandros Kapravelos · kapravelos.com

A taint-tracking build of Chromium, combined with static data-flow analysis of extension source code, follows privacy-sensitive data from extension APIs out to the network. Run over 178,893 Chrome extensions and 2,790 Opera ones, it flagged 3,868 as leaking browsing history, page content and form input, some with tens of millions of users.

Record

Researcher

Quan Chen and Alexandros Kapravelos

Published by

kapravelos.com

Format

Whitepaper

Topic

Browser

In the archive

• Collected in the 2018 research round

Tags

• browser-extension
• info-leak
• dynamic-analysis
• static-analysis
• large-scale-scan
• measurement-study
• javascript
• tooling
• detection
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of Quan Chen and Alexandros Kapravelos, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.