Collected research

On Subnormal Floating Point and Abnormal Timing

Marc Andrysco, David Kohlbrenner, Keaton Mowery, Ranjit Jhala, Sorin Lerner and Hovav Shacham · ieee-security.org

Floating point add and multiply on x86 take up to two orders of magnitude longer on subnormal operands, creating a data timing channel with no data-dependent branch. JavaScript that feeds subnormals to Firefox SVG CSS filters times rendering to steal cross-origin pixels and sniff history, and the same trick breaks the Fuzz differentially private database.

Record

Researcher

Marc Andrysco, David Kohlbrenner, Keaton Mowery, Ranjit Jhala, Sorin Lerner and Hovav Shacham

Published by

ieee-security.org

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2015 research round

Related sources

• On Subnormal Floating Point and Abnormal Timing

Tags

• timing-attack
• side-channel
• xsleak
• css
• sop-bypass
• info-leak
• javascript
• mitigation
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Marc Andrysco, David Kohlbrenner, Keaton Mowery, Ranjit Jhala, Sorin Lerner and Hovav Shacham, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.