Local Frames: Exploiting Inherited Origins to Bypass Content Blockers
Alisha Ukani, Hamed Haddadi, Alex C. Snoeren, Peter Snyder

TL;DR
This paper reveals systemic vulnerabilities in popular web privacy tools caused by mishandling local frames, exposing users to tracking and data exfiltration despite privacy protections.
Contribution
It identifies how legacy web functionalities interact unexpectedly with privacy tools, leading to exploitable vulnerabilities, and provides a systematic analysis of these issues across multiple tools and websites.
Findings
All six tested tools had at least one vulnerability.
56% of popular websites use local frames, many of which trigger vulnerabilities.
73.7% of requests from local frames should be blocked but are not.
Abstract
We present a study of how local frames (i.e., iframes loading content like "about:blank") are mishandled by a wide range of popular Web security and privacy tools. As a result, users of these tools remain vulnerable to the very attack techniques against which they seek to protect themselves, including browser fingerprinting, cookie-based tracking, and data exfiltration. The tools we study are vulnerable in different ways, but all share a root cause: legacy Web functionality interacts with browser privacy boundaries in unexpected ways, leading to systemic vulnerabilities in tools developed, maintained, and recommended by privacy experts and activists. We consider four core capabilities supported by most privacy tools and develop tests to determine whether each can be evaded through the use of local frames. We apply our tests to six popular Web privacy and security tools -- identifying…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
