Collected research

Pixel Thief: Exploiting SVG Filter Leakage in Firefox and Chrome

Sioli O'Connell, Lishay Aben Sour, Ron Magen, Daniel Genkin, Yossi Oren, Hovav Shacham and Yuval Yarom · usenix.org

Revisits pixel-stealing attacks against SVG filters, which browser vendors had addressed by removing timing variation from filter implementations. The work shows those fixes are insufficient: cache-based side-channel measurement of data-dependent memory accesses in filter rendering, together with conditions that force the CPU filter path and techniques for regaining high-resolution timers, leaks cross-origin iframe content and visited-link state at up to 267 bits per second.

Record

Researcher

Sioli O'Connell, Lishay Aben Sour, Ron Magen, Daniel Genkin, Yossi Oren, Hovav Shacham and Yuval Yarom

Published by

usenix.org

Topic

Browser

In the archive

• Collected in the 2024 research round

Related sources

• USENIX Security '24 - Pixel Thief: Exploiting SVG Filter Leakage in Firefox and Chrome

Tags

• side-channel
• xsleak
• info-leak
• iframe
• timing-attack
• css

This page is the archive's own catalogue record. The research is the work of Sioli O'Connell, Lishay Aben Sour, Ron Magen, Daniel Genkin, Yossi Oren, Hovav Shacham and Yuval Yarom, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.