Collected research

Extension Breakdown: Security Analysis of Browsers Extension Resources Control Policies

Iskander Sanchez-Rola, Igor Santos and Davide Balzarotti · usenix.org

Browsers restrict which extension resources a web page may load, but two attacks defeat those controls in every major browser family and enumerate the extensions a user has installed: a timing side channel against the access-control check, and Safari extensions whose predictable resource URIs leak directly. Enumeration feeds user fingerprinting and targeted attacks.

Record

Researcher

Iskander Sanchez-Rola, Igor Santos and Davide Balzarotti

Published by

usenix.org

Topic

Browser

In the archive

• Collected in the 2016–17 research round

Tags

• browser-extension
• timing-attack
• side-channel
• info-leak
• sop-bypass
• measurement-study
• defence
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Iskander Sanchez-Rola, Igor Santos and Davide Balzarotti, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.