Understanding and mitigating the security risks of content inclusion in web browsers

Abstract

Thanks to the wide range of features o ered by web browsers, modern websites include various types of content such as JavaScript and Cascading Style Sheets (CSS) in order to create interactive user interfaces. Browser vendors also provided extensions to enhance web browsers with additional useful capabilities that are not necessarily maintained or supported by default.However, included content can introduce security risks to users of these websites, unbeknownst to both website operators and users. In addition, the browser's interpretation of the resource URLs may be very di erent from how the web server resolves the URL to determine which resource should be returned to the browser. The URL may not correspond to an actual server-side file system structure at all, or the web server may internally rewrite parts of the URL. This semantic disconnect between web browsers and web servers in interpreting relative paths (path confusion) could be exploited by Relative Path Overwrite (RPO). On the other hand, even tough extensions provide useful additional functionality for web browsers, I would like to thank my advisors, William Robertson and Engin Kirda, for their support and valuable insights during my Ph.D. career. I am also thankful for working alongside my brilliant colleagues from whom I learned a lot: