Protecting Browser State from Web Privacy Attacks
đź“ś Abstract
Through a variety of means, including a range of browser cache methods and inspecting the color of a visited hyperlink, client-side browser state can be exploited to track users against their wishes. This tracking is possible because persistent, client-side browser state is not properly partitioned on per-site basis in current browsers. We address this problem by refining the general notion of a “same-origin” policy and implementing two browser extensions that enforce this policy on the browser cache and visited links. We also analyze various degrees of cooperation between sites to track users, and show that even if long-term browser state is properly partitioned, it is still possible for sites to use modern web features to bounce users between sites and invisibly engage in cross-domain tracking of their visitors. Cooperative privacy attacks are an unavoidable consequence of all persistent browser state that affects the behavior of the browser, and disabling or frequently expiring this state is the only way to achieve true privacy against colluding parties.
✨ Summary
The paper generalizes the browser same-origin principle beyond JavaScript and cookies to persistent browser state, stating that only the site that stores information should later be able to read or modify it. It classifies tracking as single-session, multiple-session, cooperative, semi-cooperative, and non-cooperative, and explains why third-party cookie blocking alone cannot prevent all forms of tracking.
Its technical contributions focus on two previously under-protected state mechanisms. First, it describes cache-timing, DNS-cache, cache-metadata, and cached-content attacks, and proposes partitioning cache entries according to the embedding and hosting sites. Second, it analyzes visited-link history attacks, including “chameleon” phishing pages and link-based identifiers, and proposes origin-aware history partitioning. The authors implemented these defenses as Firefox extensions and showed that cooperative sites can still link identities through redirects, popups, hyperlinks, and other navigation mechanisms even when browser state is partitioned.
The paper’s central design idea has continued into later browser privacy work. A subsequent research dissertation explicitly cites this paper as prior work on same-origin caching and reports that Chrome shipped visited-link partitioning to all users in Chrome 136 in 2025, while proposing the approach to web standards bodies. (escholarship.org) Mozilla’s Firefox State Partitioning applies a related double-keying model to client-side state using both the resource origin and top-level site; Firefox documents this as covering storage as well as network state such as HTTP, image, script, stylesheet, and DNS caches. The feature was enabled by default in Firefox 103. (developer.mozilla.org) W3C privacy guidance likewise defines partitions as user-agent boundaries intended to prevent recognition across contexts and recommends preventing cross-partition recognition unless the user intends it. (w3.org) These developments represent concrete industry and standards adoption of the paper’s broader principle: persistent browser state should be isolated according to the user’s browsing context rather than shared globally across sites. The paper was published in WWW 2006, pages 737–744. (doi.org)