W. Applications-ecosystem,

. , Evolution of CSP adoption among top 10,000 Alexa Sites between, 2016.

C. .. An,

. , Percentage of pages with CSP per site

, Differences in CSP directives for parent and iframe pages, p.48

, Differences in CSP directives for same-origin and relaxed origin pages, p.49

. Monitoring and . .. Enforcement, , vol.87

. , Performance overhead of deploying the monitor

. , Overhead introduced by applying CSP to content

. .. Privacy-preserving-web-architecture,

, Preventing trackers from combining in-context and cross-context tracking, vol.112

. , A demo page displaying a Google Maps

. , Testing 485 carefully selected extensions provides a very similar uniqueness result to testing all 16,743 extensions

. , The script detects an icon of Adblock extension and concludes that Adblock is installed. Then the script detects that the user is logged into Facebook when it successfully loads Facebook favicon.ico. It also detects that the user is logged into LinkdedIn through a CSP violation, Detection of browser extensions and Web logins. A user visits a benign website test.com which embeds third party code (the attacker' script) from attacker.com

. , Evolution of detected extensions in Chrome

. .. Users, 127 7.5 Distribution of anonymity set sizes for 16,393 users based on detected extensions and logins

. , Four final datasets. D Ext contains users, who have installed at least one detected extension and D Log contains users, who have at least one login detected

. , Anonymity sets for different datasets

, Anonymity sets for users with respect to the number of detected extensions 130

. .. , 131 7.10 Comparison of fingerprint pattern size (targeted) and the total number of detected attributes (detected) for unique users

. , Anonymity sets for different numbers of attributes tested by general fingerprinting algorithm

. , 136 7.13 Uniqueness of Chrome users based on their extensions only vs. number of users-204 is the number of users used in

, Browser extensions architecture-Communications with web applications, p.149

-. .. Methodology, , p.152

. .. Extension, 156 8.4 A.com forces an attack by opening B.com thereby allowing A.com/content to load, execute and interact with extensions in order to exfiltrate user data to A

. , CORS requests workflow in presence of an extension with the capability to intercept and manipulate HTTP headers

. , Distribution of users of extensions with the capability to tamper with CORS headers

, Distribution of users of extensions manipulating CORS headers, p.182

. .. , Categories of extensions manipulating CORS headers, p.183

. , Breaking legitimate CORS requests by adding multiple values to the Access-Control-Allow-Origin header

. , Breaking legitimate CORS requests with credentials by changing Access-Control-Allow-Origin to *

. , 2 CORS headers exchanges between web browsers and servers. In many cases, there is a one-to-one correspondence between the requests and responses headers. The browser sends a header, and the server uses its dual to authorize or reject cross-origin requests, HTTP headers (excerpt) exchanged between the browser (client) and the server for

. , Excerpt of CSP directives and their descriptions

. .. , Statistics CSP violations due to Same-Origin Policy, vol.46

, Sample of sites with CSP violations due to Same-Origin Policy, p.46

. , Potential CSP violations in pages with CSP

. .. Csp-core-syntax, 60 4.3 Formalization of Dependency-Free Policies (DF-CSP) considering CSP1, CSP2 and CSP3 versions and their implementations in browsers, p.62

. , 66 4.5 Dependencies and rewriting rules considering only CSP2 and CSP3 and their implementations in browsers

. , Dependencies and rewriting rules for CSP2 and CSP3, according to the specifications. We consider only browsers which implementations are compliant with the specifications

. , Dependencies in the wild, considering CSP1, CSP2, CSP3 and their implementations in browsers

, Matching arguments in an origin against arguments in a URL, p.89

. , Injecting dynamic third party content

. .. Dataset, 124 7.2 Previous studies on measuring uniqueness based on browser extensions and our estimation of uniqueness

. , Top seven most popular extensions in our dataset and their popularity on Chrome Web Store, vol.126

. , Top seven most popular logins in our dataset and their ranking according to Alexa

.. .. Data,

. .. Category-of-extensions,

. , Data collection and analysis results overview

, Most requested permissions among Chrome, Firefox and Opera extensions, p.179

. , Top 3 most popular categories among extensions with the ability to manipulate HTTP headers

, Sources (origins of webpages) and targets (web applications servers) of CORS requests allowed by extensions. The table reads from row to column, p.182

. , 6 Extensions breaking the Same Origin Policy-Types of authorized CORS requests

. , Breaking web applications, because of a harsh modification of CORS headers by extensions

A. , Extensions with the same code base which gives *.fliptab.io access to browsing history (get/delete), bookmarks (get), extensions (get/enable/disable/uninstall) and storage

. , Extensions with the same code base for triggering downloads from vk.com, *.vimeo.com, *.coub.com, *.kinopoisk

. , Extensions with the same code base which leaks topsites, history and/or bookmarks to *.atavi.com, *.atavi.test

, A.5 Extensions which give access to their storage to any application

A. , A.7 Chrome, Firefox and Opera extensions that can be exploited by web applications access privileged APIs and sensitive user information, 0200.

, Firefox and Opera extensions that can be exploited by web applications access privileged APIs and sensitive user information, p.201

, Firefox and Opera extensions that can be exploited by web applications access privileged APIs and sensitive user information, p.202

, Firefox and Opera extensions that can be exploited by web applications access privileged APIs and sensitive user information, p.203

, Firefox and Opera extensions that can be exploited by web applications access privileged APIs and sensitive user information, p.204

, Firefox and Opera extensions that can be exploited by web applications access privileged APIs and sensitive user information, 205 List of tools and websites

, A Monitor to Complement Content Security Policy (CSP) Expressiveness

, Analyze Message Passing APIs in Browser extensions components

, CORSER-Cross-browser extension for tampering with HTTP CORS headers

, Deploying Server-Side Tracking Protection Architecture

, Webstats-Various statistics about top 10,000 Alexa sites

, Hypertext Transfer Protocol

, A comprehensive tutorial on cross-site scripting

, Abstract Syntax Tree

. Adblock-block, Ads-Browse Safe

. Angularjs,

A. Http and S. Project,

, Application programming interface

, ASP.NET Web Framework

A. Manager,

, Boomerang for Gmail-Chrome Extension

B. Console,

, Bug 1372288-webextensions uuid can be used as user fingerprint

, Can I use Content Security Policy, vol.1, issue.0

. Cascading-style and . Sheets,

, Chrome-Publish in the Chrome Web Store

, Chrome Extensions API

, Chrome Extensions API-Content scripts and Content Security Policy

, Chrome Platform Status

, Chrome WebRequest API

, Content Security Policy (CSP)-Chrome Extensions

C. Network,

, CORS protocol-Fetch Specification

. Cross-origin and . Communications,

, Cross-origin-resource sharing

. Cross-site-scripting,

, CSP violations online

, CSS Parser for Node

U. Data, , vol.46

R. Ecmascript, Internationalization API Specification (ECMA-402, 2017.

. Firefox-submitting,

F. Accessible,

, Firefox Add-ons

F. Webrequest and A. ,

. Mozilla,

. Firefox,

. Ghostery,

G. Chrome,

. Google, Manifest-Web Accessible Resources

. Google, Manifest File Format

. Google-website,

. Google's-gmail,

. Guretv, To watch television-Firefox Extension

, HD Wallpapers from fliptab

, HTML Parser for Node

H. Standard,

, HTML5 Specification-W3C

, HTTP Commander-Chrome Extension

H. Cookies,

. Iframe-sandbox-attribute,

. Iwassa-chrome-extension,

I. Extension,

, JavaScript Object Property Access-Dot and Array Notation

, JavaScript/Reference/Global_Objects/Proxy

. Linkclicker-chrome-extension,

. Linkclicker-opera-extension,

, LinkedIn Sales NavigatorChrome Extension

, Man-in-the-middle attack

M. Extension,

, Message Passing-Google Chrome Extensions

. Microsoft-edge-extensions,

, Microsoft Internet Information Services (IIS

, MIME types

. Moderndeck-chrome-extension,

M. Extension,

. Mongodb,

M. Webextensions and A. ,

A. Mutationobserver,

. Node,

. Node and . Proxy,

, Opera-Passing Messages in Extensions

, Opera Add-ons

, Opera Extensions API

P. Attack,

, PHP: Hypertext Preprocessor

, PostMessage-Cross-Origin Iframe Secure Communication

, Publishing Guidelines-Opera Extensions

, Python Programming Language

C. Salesforceiq,

, Same Origin Policy

, Secure Hash Algorithms

, Server Side Access Control (CORS

S. Worker and A. ,

, Session Hijacking Attack

, SlimerJS-A scriptable browser for Web developers

, Space Galaxy HD Wallpapers-Chrome Extension

. Starthq,

, Telerik Test Studio Chrome Playback, vol.1, 2014.

, The Basics of Browser Helper Objects

, The OWASP Top Ten Project

T. Browser,

, Tracking Compliance and Scope

, Tracking Preference Expression

U. Identifier,

A. Urlsearchparams,

, User-Agent Switcher-Firefox Extensions

, User-Agent Switcher for Chrome-Chrome Extension

C. Using and . Rocks,

, Using Service Workers

, VisualSP Training for Office 365-Chrome Extension

, Webstats-Various statistics about top 10,000 Alexa sites

. Xmlhttprequest,

X. Interfaces,

V. Zenmate and . Extension,

. Zenmate and . Vpn-for-firefox-firefox-extension,

, European Commision Law on Cookies, 2012.

, Webstats-Use of Content Security Policy and Cookies in top 10,000 Alexa sites, 2016.

E. Abgrall, Y. L. Traon, M. Monperrus, S. Gombault, M. Heiderich et al., XSS-FP: browser fingerprinting using HTML parser quirks, 2012.
URL : https://hal.archives-ouvertes.fr/hal-00753926

G. Acar, C. Eubank, S. Englehardt, M. Juárez, A. Narayanan et al., The web never forgets: Persistent tracking mechanisms in the wild, Proc. of CCS, 2014.

G. Acar, M. Juárez, N. Nikiforakis, C. Díaz, F. Seda et al., FPDetective: dusting the web for fingerprinters, Proc. of CCS, 2013.

J. Prasad-achara, G. Ács, and C. Castelluccia, On the unicity of smartphone applications, 2015.

J. Prasad-achara, J. Parra-arnau, and C. Castelluccia, Mytrackingchoices: Pacifying the ad-block war by enforcing user privacy preferences, 2016.

S. Van-acker, D. Hausknecht, and A. Sabelfeld, Data Exfiltration in the Face of CSP, Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, pp.853-864, 2016.

T. Anthony, Detect if visitors are logged into twitter, 2012.

S. Bandhakavi, S. T. King, P. Madhusudan, and M. Winslett, VEX: vetting browser extensions for security vulnerabilities, 19th USENIX Security Symposium, pp.339-354, 2010.
DOI : 10.1145/1995376.1995398

R. Barrett and R. Cummings, Proceedings of the 26th International Conference on World Wide Web, 2017.

A. Barth, A. P. Felt, P. Saxena, and A. Boodman, Protecting browsers from extension vulnerabilities, Proceedings of the Network and Distributed System Security Symposium, NDSS 2010, 2010.

K. Boda, G. Ádám-máté-földes, S. György-gulyás, and . Imre, User tracking on the web via cross-browser fingerprinting, Proc. of the 16th NordSec, pp.31-46, 2011.
DOI : 10.1007/978-3-642-29615-4_4

, Engineering Secure Software and Systems-9th International Symposium, vol.10379, 2017.

M. Bryant, Dirty browser enumeration tricks-using chrome:// and about: to detect firefox and addons, 2014.

S. Calzavara, M. Bugliesi, S. Crafa, and E. Steffinlongo, Finegrained detection of privilege escalation attacks on browser extensions, Programming Languages and Systems-24th European Symposium on Programming, ESOP 2015, Held as Part of the European Joint Conferences on Theory and Practice of Software, vol.9032, pp.510-534, 2015.
DOI : 10.1007/978-3-662-46669-8_21

S. Calzavara, A. Rabitti, and M. Bugliesi, Content Security Problems?: Evaluating the Effectiveness of Content Security Policy in the Wild, vol.268, pp.1365-1375

S. Calzavara, A. Rabitti, and M. Bugliesi, CCSP: controlled relaxation of content security policies by runtime policy composition, Kirda and Ristenpart, vol.215, pp.695-712

S. Calzavara, A. Rabitti, and M. Bugliesi, Semantics-based analysis of content security policy deployment, ACM Trans. Web, vol.12, issue.2, 2017.
DOI : 10.1145/3149408

Y. Cao, S. Li, and E. Wijmans, cross-)browser fingerprinting via os and hardware level features, Proc. of the 24th NDSS, 2017.
DOI : 10.14722/ndss.2017.23152

N. Carlini, A. P. Felt, and D. A. Wagner, An evaluation of the google chrome extension security architecture, Proceedings of the 21th USENIX Security Symposium, pp.97-111, 2012.

G. Cattani, The evolution of chrome extensions detection, 2013.

Y. De-montjoye, C. A. Hidalgo, M. Verleysen, and V. D. Blondel, Unique in the crowd: The privacy bounds of human mobility, Scientific Reports, vol.3, p.1376, 2013.

A. Doupé, W. Cui, H. Mariusz, M. Jakubowski, C. Peinado et al., deDacota: toward preventing server-side XSS via automatic code and data separation, 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS'13, pp.1205-1216, 2013.

P. Eckersley, How Unique Is Your Web Browser?, Proc. of the 2010 PETS
DOI : 10.1007/978-3-642-14527-8_1
URL : http://www.freehaven.net/anonbib/cache/pets2010:eckersley2010unique.pdf

M. Egele, C. Kruegel, and E. Kirda, Heng Yin, and Dawn Xiaodong Song. Dynamic spyware analysis, Proceedings of the 2007 USENIX Annual Technical Conference, pp.233-246, 2007.

A. Elsobky, Novel techniques for user deanonymization attacks, 2016.

S. Englehardt and A. Narayanan, Online tracking: A 1-million-site measurement and analysis, Proc. of the 2016 CCS, pp.1388-1401, 2016.

S. Englehardt, D. Reisman, C. Eubank, P. Zimmerman, J. Mayer et al., Cookies that give you away: The surveillance implications of web tracking, Proc. of the 24th WWW, pp.289-299, 2015.
DOI : 10.1145/2736277.2741679

H. Gamboa, A. L. Fred, and A. K. Jain, Webbiometrics: User verification via web interaction, Biometrics Symposium, pp.1-6, 2007.
DOI : 10.1109/bcc.2007.4430552

A. Gómez-boix, P. Laperdrix, and B. Baudry, Hiding in the crowd: an analysis of the effectiveness of browser fingerprinting at large scale, Proceedings of the 2018 World Wide Web Conference on World Wide Web, pp.309-318, 2018.

W. De and G. , Client-and Server-Side Security Technologies for JavaScript Web Applications ; Beveiligingstechnologiën voor webapplicaties in JavaScript, 2016.

J. Grossman, I know what you've got, 2006.

J. Grossman, Login detection, whose problem is it?, 2008.

A. Guha, M. Fredrikson, B. Livshits, and N. Swamy, Verified security for browser extensions, 32nd IEEE Symposium on Security and Privacy, pp.115-130, 2011.
DOI : 10.1109/sp.2011.36
URL : http://research.microsoft.com/users/livshits/papers%5Cpdf%5Cibex11.pdf

G. Gábor-györgy-gulyás, C. Acs, and . Castelluccia, Code repository for paper titled 'near-optimal fingerprinting with constraints, 2016.

G. Gábor-györgy-gulyás, C. Acs, and . Castelluccia, Near-optimal fingerprinting with constraints, Proceedings on Privacy Enhancing Technologies, vol.2016, pp.470-487, 2016.

D. F. Gábor-györgy-gulyás, N. Somé, C. Bielova, and . Castellucia, To extend or not to extend: on the uniqueness of browser extensions and web logins, To appear in the Proceedings of the 2018 ACM on Workshop on Privacy in the Electronic Society, 2018.

J. Haag, Modern and flexible browser fingerprinting library

D. Hausknecht, J. Magazinius, and A. Sabelfeld, May I?-Content Security Policy Endorsement for Browser Extensions, Detection of Intrusions and Malware, and Vulnerability Assessment-12th International Conference, DIMVA 2015, vol.9148, pp.261-281, 2015.
DOI : 10.1007/978-3-319-20550-2_14
URL : http://www.cse.chalmers.se/%7Eandrei/dimva15.pdf

B. Hayes, Uniquely me! how much information does it take to single out one person among billions?, vol.102, pp.106-109, 2014.

S. Heule, D. Rifkin, A. Russo, and D. Stefan, The most dangerous code in the browser, 15th Workshop on Hot Topics in Operating Systems, HotOS XV, Kartause Ittingen, 2015.

I. Hickson, R. Berjon, S. Faulkner, T. Leithead, E. D. Navara et al., HTML5. A vocabulary and associated APIs for HTML and XHTML. W3C Recommendation, 2014.

A. Hidayat, ECMAScript Parsing Infrastructure

A. Hidayat, PhantomJS Headless Browser, pp.2010-2016

E. Homakov, Using content-security-policy for evil, 2014.

E. Homakov, Profilejacking-legal tricks to detect user profile, 2015.

C. Jackson and A. Barth, Beware of Finer-Grained Origins, Web 2.0 Security and Privacy, 2008.
DOI : 10.1007/978-1-349-13729-9_23

A. Javed and . Aider, An Automated Recommendation of Content Security Policy for Web Applications, IEEE Oakland Web 2.0 Security and Privacy (W2SP'12), 2012.

P. A. Simon-holm-jensen, A. Jonsson, and . Møller, Remedying the eval that men do, International Symposium on Software Testing and Analysis, vol.2012, pp.34-44, 2012.

M. Johns, Preparedjs: Secure script-templates for javascript, pp.102-121
DOI : 10.1007/978-3-642-39235-1_6

M. Johns, Script-templates for the content security policy, J. Inf. Sec. Appl, vol.19, issue.3, pp.209-223, 2014.
DOI : 10.1016/j.jisa.2014.03.007

A. Kapravelos, C. Grier, N. Chachra, C. Kruegel, G. Vigna et al., Hulk: Eliciting malicious behavior in browser extensions, Proceedings of the 23rd USENIX Security Symposium, pp.641-654, 2014.

C. Kerschbaumer, S. Stamm, and S. Brunthaler, Injecting CSP for Fun and Security, Proceedings of the 2nd International Conference on Information Systems Security and Privacy (ICISSP 2016), pp.15-25, 2016.
DOI : 10.5220/0005650100150025
URL : http://research.sidstamm.com/papers/csp_icissp_2016.pdf

, USENIX Association, 26th USENIX Security Symposium, 2017.

K. Kotowitz, Intro to chrome addons hacking: fingerprinting, 2012.

B. Krishnamurthy and C. E. Wills, Privacy diffusion on the web: a longitudinal perspective, Proc. of the 18th WWW, pp.541-550, 2009.
DOI : 10.1145/1526709.1526782

P. Laperdrix, Browser Fingerprinting: Exploring Device Diversity to Augment Authentication and Build Client-Side Countermeasures. (Empreinte digitale d'appareil: exploration de la diversité des terminaux modernes pour renforcer l'authentification en ligne et construire descontremesures côté client), INSA Rennes, 2017.

P. Laperdrix, B. Baudry, and V. Mishra, Fprandom: Randomizing core browser objects to break advanced device fingerprinting techniques, vol.174, pp.97-114
DOI : 10.1007/978-3-319-62105-0_7
URL : https://hal.archives-ouvertes.fr/hal-01527580

P. Laperdrix, B. Walter-rudametkin, and . Baudry, Mitigating browser fingerprint tracking: Multi-level reconfiguration and diversification, 10th IEEE/ACM International Symposium on Software Engineering for Adaptive and Self-Managing Systems, pp.98-108, 2015.
DOI : 10.1109/seams.2015.18
URL : https://hal.archives-ouvertes.fr/hal-01121108

P. Laperdrix, B. Walter-rudametkin, and . Baudry, Beauty and the beast: Diverting modern web browsers to build unique browser fingerprints, IEEE Symposium on Security and Privacy, vol.2016, pp.878-894, 2016.
DOI : 10.1109/sp.2016.57
URL : https://hal.archives-ouvertes.fr/hal-01285470

A. Lerner, A. K. Simpson, T. Kohno, and F. Roesner, Internet jones and the raiders of the lost trackers: An archaeological study of web tracking from 1996 to, Proc. of the 25th USENIX Security, 2016.

R. Linus, Your social media fingerprint, 2016.

M. Ter-louw, J. S. Lim, and V. N. Venkatakrishnan, Extensible web browser security, Detection of Intrusions and Malware, and Vulnerability Assessment, 4th International Conference, vol.4579, pp.1-19, 2007.

J. R. Mayer and J. C. Mitchell, Third-party web tracking: Policy and technology, Proc. of the 2012 IEEE SP, pp.413-427, 2012.
DOI : 10.1109/sp.2012.47
URL : https://cyberlaw.stanford.edu/files/publication/files/trackingsurvey12.pdf

G. Merzdovnik, M. Huber, D. Buhov, N. Nikiforakis, S. Neuner et al., Block me if you can: A large-scale study of tracker-blocking tools, Proc. of the 2nd EuroSP, 2017.

K. Mowery and H. Shacham, Pixel perfect: Fingerprinting canvas in HTML5, Proceedings of W2SP 2012, 2012.

B. Newman, JavaScript Syntax Tree Transformer

N. Nikiforakis, L. Invernizzi, A. Kapravelos, S. Van-acker, W. Joosen et al., You are what you include: large-scale evaluation of remote javascript inclusions, Proc. of the 2012 CCS, pp.736-747, 2012.

N. Nikiforakis, A. Kapravelos, W. Joosen, C. Kruegel, F. Piessens et al., Cookieless monster: Exploring the ecosystem of webbased device fingerprinting, 2013 IEEE Symposium on Security and Privacy, pp.541-555, 2013.

?. Olejnik, C. Castelluccia, and A. Janc, Why johnny can't browse in peace: On the uniqueness of web browsing history patterns, Hot Topics in Privacy Enhancing Technologies, pp.7-2012, 2012.
URL : https://hal.archives-ouvertes.fr/hal-00747841

K. Onarlioglu, M. Battal, W. K. Robertson, and E. Kirda, Securing legacy firefox extensions with SENTINEL, vol.241, pp.122-138
DOI : 10.1007/978-3-642-39235-1_7
URL : http://repository.bilkent.edu.tr/bitstream/11693/27988/1/Securing%20legacy%20firefox%20extensions%20with%20SENTINEL.pdf

K. Onarlioglu, A. S. Buyukkayhan, W. K. Robertson, and E. Kirda, SENTINEL: securing legacy firefox extensions, Computers & Security, vol.49, pp.147-161, 2015.
DOI : 10.1016/j.cose.2014.12.002
URL : http://seclab.ccs.neu.edu/static/publications/cs2015sentinel.pdf

X. Pan, Y. Cao, and Y. Chen, I do not know what you visited last summer: Protecting users from stateful third-party web tracking with trackingfree browser, Proc. of the 22nd NDSS, 2015.
DOI : 10.14722/ndss.2015.23163

X. Pan, Y. Cao, S. Liu, Y. Zhou, Y. Chen et al., CSPAutoGen: Black-box Enforcement of Content Security Policy upon Real-world Websites, vol.268, pp.653-665

K. Patil and B. Frederik, A Measurement Study of the Content Security Policy on Real-World Applications. I. J. Network Security, vol.18, issue.2, pp.383-392, 2016.

I. Paul, Firefox will stop supporting plugins by end of 2016, following chrome's lead

N. Perriault, CasperJS navigation and scripting tool for PhantomJS, pp.2011-2016

M. Pusara and C. Brodley, User re-authentication via mouse movements, ACM Workshop Visualizat. Data Mining Comput. Security, pp.1-8, 2004.
DOI : 10.1145/1029208.1029210

G. Richards, C. Hammer, B. Burg, and J. Vitek, The eval that men do-A large-scale study of the use of eval in javascript applications, ECOOP 2011-Object-Oriented Programming-25th European Conference, vol.6813, pp.52-78, 2011.

K. Rieck, P. Stewin, and J. Seifert, Detection of Intrusions and Malware, and Vulnerability Assessment-10th International Conference, DIMVA 2013, vol.7967, 2013.

F. Roesner, T. Kohno, and D. Wetherall, Detecting and defending against third-party tracking on the web, Proc. of the 9th NSDI, pp.155-168, 2012.

J. Roth, X. Liu, and D. Metaxas, On continuous user authentication via typing behavior, vol.23, pp.4611-4624, 2014.
DOI : 10.1109/tip.2014.2348802

G. Rydstedt, E. Bursztein, D. Boneh, and C. Jackson, Busting frame busting: a study of clickjacking vulnerabilities at popular sites, IEEE Oakland Web 2.0 Security and Privacy, 2010.

I. Sánchez-rola, I. Santos, and D. Balzarotti, Extension breakdown: Security analysis of browsers extension resources control policies, Kirda and Ristenpart, vol.215, pp.679-694

J. Schuh, Canvas DefendeSaying Goodbye to Our Old Friend NPAPI, 2013.

M. Serrano, Hop.js-Multi-tier JavaScript
URL : https://hal.archives-ouvertes.fr/hal-00498507

K. Singh, A. Moshchuk, H. J. Wang, and W. Lee, On the Incoherencies in Web Browser Access Control Policies, 31st IEEE Symposium on Security and Privacy, vol.2010, pp.463-478, 2010.

A. Sjösten, S. Van-acker, and A. Sabelfeld, Discovering browser extensions via web accessible resources, Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy, pp.329-336, 2017.

A. Soltani, S. Canty, Q. Mayo, L. Thomas, and C. J. Hoofnagle, Flash Cookies and Privacy, AAAI spring symposium: intelligent information privacy management, pp.158-163, 2010.

D. Somé, Breaking the Same Origin Policy for free-On CORS headers manipulations by browser extensions

D. Somé, EmPoWeb: Empowering web applications with browser extensions

D. Francis-somé, N. Bielova, and T. Rezk, On the Content Security Policy violations due to the Same-Origin Policy

D. Francis-somé, N. Bielova, and T. Rezk, Control what you include!-server-side protection against third party web tracking, vol.174, pp.115-132

D. Francis-somé, N. Bielova, and T. Rezk, On the content security policy violations due to the same-origin policy, vol.171, pp.877-886

F. Dolière, T. Somé, and . Rezk, DF-CSP: Dependency-Free Content Security Policy

F. Dolière, T. Somé, and . Rezk, Extending Content Security Policy: Blacklisting, URL arguments filtering and Monitoring

S. Stamm, B. Sterne, and G. Markham, Reining in the web with content security policy, Proceedings of the 19th International Conference on World Wide Web, WWW 2010, pp.921-930, 2010.

O. Starov and N. Nikiforakis, Extended tracking powers: Measuring the privacy diffusion enabled by browser extensions, vol.171, pp.1481-1490

O. Starov and N. Nikiforakis, XHOUND: quantifying the fingerprintability of browser extensions, 2017 IEEE Symposium on Security and Privacy, pp.941-956, 2017.

B. Sterne and A. Barth, Content Security Policy 1.0. W3C Candidate Recommendation, 2012.

N. Swamy, C. Fournet, A. Rastogi, K. Bhargavan, J. Chen et al., Gradual typing embedded securely in JavaScript, The 41st Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL '14, pp.425-438, 2014.
URL : https://hal.archives-ouvertes.fr/hal-00940836

N. Takei, T. Saito, K. Takasu, and T. Yamada, Web browser fingerprinting using only cascading style sheets, Proc. of the 10th BWCCA, pp.57-63, 2015.

R. Upathilake, Y. Li, and A. Matrawy, A classification of web browser fingerprinting techniques, Proc. of the 7th NTMS, pp.1-5, 2015.

A. Van-kesteren, Cross Origin Resource Sharing. W3C Recommendation, 2014.

A. Vastel, P. Laperdrix, W. Rudametkin, and R. Rouvoy, FPSTALKER: tracking browser fingerprint evolutions, 2018 IEEE Symposium on Security and Privacy, pp.728-741, 2018.
URL : https://hal.archives-ouvertes.fr/hal-01652021

L. Weichselbaum, M. Spagnuolo, S. Lekies, and A. Janc, CSP Is Dead, Long Live CSP! On the Insecurity of Whitelists and the Future of Content Security Policy, vol.268, pp.1376-1387

E. R. Weippl, S. Katzenbeisser, C. Kruegel, A. C. Myers, and S. Halevi, Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, 2016.

M. Weissbacher, T. Lauinger, and W. K. Robertson, Why Is CSP Failing? Trends and Challenges in CSP Adoption, Research in Attacks, Intrusions and Defenses-17th International Symposium, pp.212-233, 2014.

M. Weissbacher, E. Mariconti, G. Suarez-tangil, G. Stringhini, W. K. Robertson et al., Ex-ray: Detection of history-leaking browser extensions, Proceedings of the 33rd Annual Computer Security Applications Conference, pp.590-602, 2017.

M. West, Content Security Policy: Embedded Enforcement, 2016.

M. West, Content Security Policy Level 3. W3C Working Draft, 2016.

M. West, Mixed Content, 2016.

M. West, Origin Policy. A Collection of Interesting Ideas, 2016.

M. West, A. Barth, and D. Veditz, Content Security Policy Level 2. W3C Candidate Recommendation, 2015.

M. West and I. Grigorik, Feature Policy. W3C Draft Community Group Report, 2016.

R. Wu, CRX Extension Source Viewer For Chrome

I. Yusof and A. Pathan, Mitigating Cross-Site Scripting Attacks with a Content Security Policy, IEEE Computer, vol.49, issue.3, pp.56-63, 2016.

Y. Zhong, Y. Deng, and A. K. Jain, Keystroke dynamics for user authentication, 2012 IEEE Computer Society Conference on Computer Vision and Pattern Recognition Workshops, pp.117-123, 2012.