{"id":"https://openalex.org/W4388856986","doi":"https://doi.org/10.1145/3576915.3616598","title":"Finding All Cross-Site Needles in the DOM Stack: A Comprehensive Methodology for the Automatic XS-Leak Detection in Web Browsers","display_name":"Finding All Cross-Site Needles in the DOM Stack: A Comprehensive Methodology for the Automatic XS-Leak Detection in Web Browsers","publication_year":2023,"publication_date":"2023-11-15","ids":{"openalex":"https://openalex.org/W4388856986","doi":"https://doi.org/10.1145/3576915.3616598"},"language":"en","primary_location":{"id":"doi:10.1145/3576915.3616598","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3576915.3616598","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3576915.3616598","source":null,"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3576915.3616598","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017195339","display_name":"Dominik Trevor No\u00df","orcid":"https://orcid.org/0000-0002-2138-9989"},"institutions":[{"id":"https://openalex.org/I904495901","display_name":"Ruhr University Bochum","ror":"https://ror.org/04tsk2644","country_code":"DE","type":"education","lineage":["https://openalex.org/I904495901"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Dominik Trevor No\u00df","raw_affiliation_strings":["Ruhr University Bochum, Bochum, Germany"],"raw_orcid":"https://orcid.org/0000-0002-2138-9989","affiliations":[{"raw_affiliation_string":"Ruhr University Bochum, Bochum, Germany","institution_ids":["https://openalex.org/I904495901"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103109219","display_name":"Lukas Knittel","orcid":"https://orcid.org/0009-0006-5676-5151"},"institutions":[{"id":"https://openalex.org/I904495901","display_name":"Ruhr University Bochum","ror":"https://ror.org/04tsk2644","country_code":"DE","type":"education","lineage":["https://openalex.org/I904495901"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Lukas Knittel","raw_affiliation_strings":["Ruhr University Bo\u00adchum, Bochum, Germany"],"raw_orcid":"https://orcid.org/0009-0006-5676-5151","affiliations":[{"raw_affiliation_string":"Ruhr University Bo\u00adchum, Bochum, Germany","institution_ids":["https://openalex.org/I904495901"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060434302","display_name":"Christian Mainka","orcid":"https://orcid.org/0000-0002-4273-645X"},"institutions":[{"id":"https://openalex.org/I904495901","display_name":"Ruhr University Bochum","ror":"https://ror.org/04tsk2644","country_code":"DE","type":"education","lineage":["https://openalex.org/I904495901"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Christian Mainka","raw_affiliation_strings":["Ruhr University Bochum, Bochum, Germany"],"raw_orcid":"https://orcid.org/0000-0002-4273-645X","affiliations":[{"raw_affiliation_string":"Ruhr University Bochum, Bochum, Germany","institution_ids":["https://openalex.org/I904495901"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5034652773","display_name":"Marcus Niemietz","orcid":"https://orcid.org/0009-0006-1726-8099"},"institutions":[{"id":"https://openalex.org/I4210113269","display_name":"Hochschule Niederrhein","ror":"https://ror.org/027b9qx26","country_code":"DE","type":"education","lineage":["https://openalex.org/I4210113269"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Marcus Niemietz","raw_affiliation_strings":["Niederrhein University of Applied Sciences, Krefeld, Germany"],"raw_orcid":"https://orcid.org/0009-0006-1726-8099","affiliations":[{"raw_affiliation_string":"Niederrhein University of Applied Sciences, Krefeld, Germany","institution_ids":["https://openalex.org/I4210113269"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5053201224","display_name":"J\u00f6rg Schwenk","orcid":"https://orcid.org/0000-0001-9315-7354"},"institutions":[{"id":"https://openalex.org/I904495901","display_name":"Ruhr University Bochum","ror":"https://ror.org/04tsk2644","country_code":"DE","type":"education","lineage":["https://openalex.org/I904495901"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"J\u00f6rg Schwenk","raw_affiliation_strings":["Ruhr University Bochum, Bochum, Germany"],"raw_orcid":"https://orcid.org/0000-0001-9315-7354","affiliations":[{"raw_affiliation_string":"Ruhr University Bochum, Bochum, Germany","institution_ids":["https://openalex.org/I904495901"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.6479,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.69519604,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":null,"issue":null,"first_page":"2456","last_page":"2470"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9993000030517578,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9991000294685364,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7607430219650269},{"id":"https://openalex.org/keywords/leak","display_name":"Leak","score":0.6341933608055115},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.5262376666069031},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5010895729064941},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.46984854340553284},{"id":"https://openalex.org/keywords/state","display_name":"State (computer science)","score":0.4433530569076538},{"id":"https://openalex.org/keywords/memory-leak","display_name":"Memory leak","score":0.41346073150634766},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3232887089252472},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.31458723545074463},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.28533387184143066},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.13715457916259766},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.12205499410629272}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7607430219650269},{"id":"https://openalex.org/C2780378346","wikidata":"https://www.wikidata.org/wiki/Q1349983","display_name":"Leak","level":2,"score":0.6341933608055115},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5262376666069031},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5010895729064941},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.46984854340553284},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.4433530569076538},{"id":"https://openalex.org/C156731835","wikidata":"https://www.wikidata.org/wiki/Q751740","display_name":"Memory leak","level":4,"score":0.41346073150634766},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3232887089252472},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.31458723545074463},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.28533387184143066},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.13715457916259766},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.12205499410629272},{"id":"https://openalex.org/C176649486","wikidata":"https://www.wikidata.org/wiki/Q2308807","display_name":"Memory management","level":3,"score":0.0},{"id":"https://openalex.org/C87717796","wikidata":"https://www.wikidata.org/wiki/Q146326","display_name":"Environmental engineering","level":1,"score":0.0},{"id":"https://openalex.org/C136085584","wikidata":"https://www.wikidata.org/wiki/Q910289","display_name":"Overlay","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3576915.3616598","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3576915.3616598","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3576915.3616598","source":null,"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3576915.3616598","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3576915.3616598","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3576915.3616598","source":null,"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[{"score":0.7900000214576721,"id":"https://metadata.un.org/sdg/10","display_name":"Reduced inequalities"}],"awards":[{"id":"https://openalex.org/G18682879","display_name":"EXC 2092: CyberSicherheit im Zeitalter gro\u00dfskaliger Angreifer (CASA)","funder_award_id":"390781972","funder_id":"https://openalex.org/F4320320879","funder_display_name":"Deutsche Forschungsgemeinschaft"},{"id":"https://openalex.org/G5507498682","display_name":null,"funder_award_id":"13I40V002C","funder_id":"https://openalex.org/F4320321469","funder_display_name":"Bundesministerium f\u00fcr Wirtschaft und Technologie"}],"funders":[{"id":"https://openalex.org/F4320320879","display_name":"Deutsche Forschungsgemeinschaft","ror":"https://ror.org/018mejw64"},{"id":"https://openalex.org/F4320321469","display_name":"Bundesministerium f\u00fcr Wirtschaft und Technologie","ror":"https://ror.org/02vgg2808"},{"id":"https://openalex.org/F4320335322","display_name":"European Regional Development Fund","ror":"https://ror.org/00k4n6c32"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4388856986.pdf","grobid_xml":"https://content.openalex.org/works/W4388856986.grobid-xml"},"referenced_works_count":12,"referenced_works":["https://openalex.org/W2103262407","https://openalex.org/W2723746209","https://openalex.org/W2793337260","https://openalex.org/W3008757785","https://openalex.org/W3094160557","https://openalex.org/W3210461732","https://openalex.org/W3214196324","https://openalex.org/W3216878076","https://openalex.org/W4206275846","https://openalex.org/W4281396748","https://openalex.org/W4301351737","https://openalex.org/W4385679748"],"related_works":["https://openalex.org/W2338094139","https://openalex.org/W2583782559","https://openalex.org/W2945751699","https://openalex.org/W2607488157","https://openalex.org/W2796199216","https://openalex.org/W3116952012","https://openalex.org/W2001055266","https://openalex.org/W4402856056","https://openalex.org/W3138351078","https://openalex.org/W2355497386"],"abstract_inverted_index":{"Cross-Site":[0],"Leaks":[1],"(XS-Leaks)":[2],"are":[3,85],"a":[4,10,18,26,30,35,45,53,58,65,71],"class":[5],"of":[6,60,95],"vulnerabilities":[7],"that":[8],"allow":[9],"web":[11,20],"attacker":[12],"to":[13,47],"infer":[14],"user":[15],"state":[16],"from":[17],"target":[19],"application":[21],"cross-origin.":[22,125],"Fixing":[23],"XS-Leaks":[24],"is":[25,33,37],"cat-and-mouse":[27],"game:":[28],"once":[29,79],"published":[31],"vulnerability":[32],"fixed,":[34],"variant":[36],"discovered.":[38],"To":[39],"end":[40],"this":[41,76],"game,":[42],"we":[43],"propose":[44],"methodology":[46],"find":[48],"all":[49,96],"leak":[50,97],"techniques":[51,98],"for":[52,80],"given":[54],"state-dependent":[55],"resource":[56],"and":[57,108,115,120],"set":[59,94],"inclusion":[61],"method.":[62],"We":[63,74,90],"translate":[64],"website's":[66],"DOM":[67,118],"at":[68],"runtime":[69],"into":[70],"directed":[72],"graph.":[73],"execute":[75],"translation":[77],"twice,":[78],"each":[81],"state.":[82],"The":[83,105],"outputs":[84],"two":[86,102,113],"slightly":[87],"different":[88],"graphs.":[89],"then":[91],"get":[92],"the":[93,112,116],"by":[99],"computing":[100],"these":[101],"graphs'":[103],"differences.":[104],"remaining":[106],"nodes":[107],"edges":[109],"differ":[110],"between":[111],"states,":[114],"corresponding":[117],"properties":[119],"objects":[121],"can":[122],"be":[123],"observed":[124]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-10-10T00:00:00"}