{"id":"57bec988-5bd2-41e3-a187-37c519b680c3","arxiv_id":"1908.02204","paper_version":2,"verdict":"ACCEPT","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"low","formal_verification":"none","parameter_count":2,"one_line_summary":"The paper introduces a taxonomy of 40 COSI attack classes, a new postMessage-based XS-Leak, and the Basta-COSI tool, which finds state-leaking attacks on all 62 tested targets.","lead":"This paper shows how a malicious web page can infer private details about a visitor, such as whether they are logged into a site or own a specific account, by observing small differences in how the browser loads cross-origin resources. The authors build a tool that systematically finds such 'XS-Leak' attacks and report at least one on every one of 62 sites tested, including deanonymization attacks on 36 popular sites.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Live-site counts rely on an unverified transfer from testbed signatures; the false-positive rate is disclosed but unquantified, so the headline numbers are tool detections, not confirmed exploits.","rationale":"The reader's ACCEPT verdict is appropriate. The core contributions—the systematization into 40 attack classes, the novel postMessage XS-Leak, the multi-vector combination algorithm, and the released open-source tool—are supported by independent validation of representative attacks and by vendor acknowledgements (HotCRP, GitLab, GitHub, LinkedIn, Imgur). The weakest point is exactly what the reader identified: the transfer from controlled testbed signatures to live-site counts, compounded by the lack of end-to-end execution of every generated attack page and by the acknowledged but unquantified false positives from timeouts and CAPTCHAs. I considered whether this should lower the verdict, but the paper's own language ('discovers', 'tool detections') and its explicit limitations in Sections VI-B and VIII prevent the headline counts from being read as fully verified exploits. The proposed end-to-end re-run on a sample would settle the residual uncertainty; unless it demonstrates a high false-positive rate, the central contributions stand. No additional load-bearing concern emerged from the attack-class definitions, the browser support claims, or the vector-selection algorithm.","tokens_in":26230,"tokens_out":11395,"duration_ms":132026,"concrete_test":"Randomly sample 25 of the 62 targets and re-run the Basta-COSI-generated login-detection attack page for each in a clean Chrome, Firefox, and Edge profile under two conditions: logged in with a fresh test account and logged out. Compare the page's reported state with the known state; also repeat for 10 of the 36 deanonymization attack pages using the appropriate owner and non-owner accounts. If any sampled page misclassifies, record the error rate; if the combined error rate exceeds roughly 5%, the Section VI counts should be re-reported as potential attacks pending per-page confirmation rather than confirmed vulnerable counts.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that Basta-COSI can automatically build attack pages that distinguish more than two states across Chrome, Firefox, and Edge, and that applying it to 62 targets finds at least one COSI attack for every one. The load-bearing link is in Section IV-B: a SD-URL becomes an attack vector when its collected responses match an attack-class signature, and the generated attack page (Section IV-C) is not executed and verified for every match. Thus the aggregate 'vulnerable' counts in Table VI depend on the assumption that signature equality on the controlled test application (Section III-A) implies the same observable browser event or DOM-property difference on a live site for the particular victim state. The paper itself notes in Section VI-B that false positives occurred from the 6-second event-collection timeout and from CAPTCHAs, but it does not quantify how many of the 62 login detections, 36 deanonymizations, 12 SSO-status findings, or 5 access detections were manually confirmed. Positive evidence exists for selected attacks (HotCRP, GitLab, GitHub, LinkedIn, Blogger, Imgur), and some were vendor-acknowledged, but not for the aggregate counts. Because the headline is phrased as 'Basta-COSI discovers' rather than 'we verified', this is a real but non-fatal limitation: if the false-positive rate were large, the empirical measurement claim would weaken, while the methodology and systematization contributions would remain intact.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper systematizes cross-origin state inference (COSI) attacks, which use browser XS-Leaks to infer a victim's state (login status, account type, content ownership, etc.) at a target web site. The authors introduce the concept of a COSI attack class, propose two generalization/amplification techniques that turn 31 known attack instances into 40 attack classes, and claim to discover a novel XS-Leak based on window.postMessage. They implement these ideas in a tool called Basta-COSI, which crawls a target, identifies state-dependent URLs, matches them to attack classes, and composes attack pages that combine multiple attack vectors to distinguish more than two states across Chrome, Firefox, and Edge. The tool is evaluated on 4 locally installed web applications and 58 popular live sites, reporting at least one COSI attack against every target: login detection on all 62, account deanonymization on 36, account type detection on 5, SSO status on 12, and access detection on 5. The paper also discusses defenses and discloses limitations, including known false positives from event-collection timeouts and CAPTCHAs.","tokens_in":26556,"tokens_out":6192,"duration_ms":59059,"significance":"If the claims hold, this is a substantive systematization and engineering contribution: it unifies previously scattered login-detection, cross-site search, and related attacks under a common framework; it provides 40 reusable attack classes; it demonstrates a genuinely new postMessage-based XS-Leak; and it ships an open-source tool, with several findings confirmed or patched by vendors (HotCRP, GitLab, GitHub, LinkedIn, Imgur). The methodology is careful in the testbed: attack instances are validated on a controlled application, state scripts are used consistently, and the tool's limitation of only finding instances of its 40 classes is acknowledged. The main risk is that the headline empirical claim—'at least one COSI attack against all 62 targets'—is supported by signature matching against live sites, not by end-to-end confirmation for each target, and the disclosed false-positive sources are not quantified.","major_comments":[{"comment":"The headline counts in Table VI (58/58 login detection, 36 deanonymization, 12 SSO status, 5 access detection, 3 account type) are produced by Basta-COSI matching live-site responses to attack-class signatures, not by manual verification of each finding. The paper discloses two false-positive causes (the 6-second event-collection timeout and CAPTCHAs) but does not state how many of the 62 targets' findings were re-tested in a real browser, nor how many were manually confirmed. Because the abstract and conclusion phrase the result as 'finding COSI attacks against each of them,' the aggregate counts should either be accompanied by a per-target confirmation table or a measured false-positive rate, or the claims should be explicitly re-scoped to 'candidate attacks' with a clear separation between confirmed and unconfirmed findings.","section":"Section VI-B, Table VI"},{"comment":"The load-bearing link between the testbed and live sites is the assumption that a response signature observed on the authors' controlled test application (Section III-A) implies the same browser-observable difference when the same SD-URL is included in a real victim browser on a live site. The paper validates selected attacks end-to-end (e.g., HotCRP, GitLab, GitHub, LinkedIn, Blogger, Imgur) and reports vendor confirmations, but it does not verify the matched vectors for the majority of the 62 targets. Dynamic factors such as bot detection, A/B testing, personalized content, and CAPTCHAs can invalidate a signature match. I would like to see a systematic validation: for each target, execute the generated attack page in a real browser for a sample of matched vectors and report the success rate; alternatively, state explicitly which aggregate numbers are tool detections and which are confirmed.","section":"Section III-A and Section IV-B"},{"comment":"The free parameters used by Basta-COSI are not justified or analyzed. The event-collection timeout of 6 seconds is identified as a source of false positives, and the postMessage attack class uses a Jaro string distance threshold to compare message content, but no sensitivity analysis or rationale is given for either value. Since the false-positive rate is load-bearing for the empirical claims, the authors should report how these parameters were chosen and whether the aggregate results in Table VI are robust to reasonable variations (e.g., a 10-second timeout or a different Jaro threshold).","section":"Section IV-B and Section VI-B"}],"minor_comments":[{"comment":"The phrase 'apriori' appears in the abstract and in Section I; it should be 'a priori.'","section":"Abstract and Section I"},{"comment":"Table III is dense and uses abbreviations such as sc, ct, xcto, cd, and bdy that are defined only in the text of Section III-B. Moving the abbreviation definitions into the table caption would improve readability.","section":"Table III"},{"comment":"The score function used in Algorithm 1 is described only qualitatively ('penalizing attack classes that may interfere with other vectors'). A concrete definition of the score and the interference penalty would make the greedy selection reproducible.","section":"Section IV-C, Algorithm 1"},{"comment":"The legend in Table VII uses 'EventFire' while the text and Table III use 'EventsFired'; please harmonize the terminology. Also, the browser abbreviations C, E, F in Table V are introduced in the caption of Table VI but would benefit from a note in Table V's caption.","section":"Table VII"},{"comment":"The paper states that Basta-COSI 'can only find COSI attacks that are instances of the 40 attack classes it supports' and does not evaluate false negatives. This is a reasonable and honest limitation; however, the conclusion's phrase 'finding COSI attacks against each of them' could be read as a stronger prevalence claim than the class-bounded detection can support. A sentence clarifying that the result is a lower bound within the supported class library would prevent overinterpretation.","section":"Section VI-B"}],"recommendation":"major_revision","confidential_remarks":"The paper is well within the journal's scope and represents a solid systematization and tool-building contribution. The reader's accept recommendation is defensible; my main reservation is that the aggregate 'vulnerable' counts in Table VI are tool-derived and the paper does not quantify the false-positive rate it explicitly acknowledges. If the authors add a confirmation study or carefully re-scope the claims, the paper would be acceptable. I would not support rejection, as the methodology, the novel postMessage XS-Leak, and the vendor-confirmed case studies are strong and the limitation is clearly disclosed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague, here is my read of the COSI paper. The core contribution is genuine: the first systematic treatment of XS-Leaks as a unified attack class, with a working taxonomy of 40 classes, a new postMessage leak, and a tool that combines multiple leak vectors to distinguish more than two states across browsers. That combination is the real advance over prior work, which mostly handled one leak, two states, and a single browser. The tool is released, and several findings were vendor-confirmed (HotCRP, GitLab, GitHub, LinkedIn, Imgur), so the central claims carry real weight.\n\nThe soft spot is the headline counts. Basta-COSI \"discovers at least one COSI attack\" on all 62 targets, but most of those are signature matches from the controlled testbed, not manually verified exploits. The paper discloses false positives from slow loads and CAPTCHAs but does not quantify them. So the honest reading is: these are tool detections, some confirmed, likely true for many but not all. That does not sink the paper—the method, taxonomy, and postMessage leak stand on their own—but it does make the empirical reach less crisp than the abstract suggests.\n\nThere is also an in-built circularity: the tool can only find attacks that are instances of the 40 classes it already knows. So \"all sites vulnerable\" is partly an artifact of the class definitions. The authors acknowledge this in Sections VI-B and VIII, and the independent validations show the classes are not vacuous, but the aggregate numbers should be interpreted accordingly.\n\nOn the literature: the citation pattern looks honest. Table VIII is a useful survey of 23 prior works, and the authors correctly note that 15 of 40 classes generalize prior attacks. The related work is thorough. The two free parameters (event timeout, Jaro threshold) are minor and typical for this kind of tool.\n\nWho gets value: any web security researcher working on side channels, SOP bypasses, or privacy leaks; also browser vendors and site operators. I would bring it to our reading group, and I would cite it in my own work. It deserves serious peer review—the systematization is important enough that even with the unquantified false-positive rate, it should receive a thorough review rather than a desk reject. My recommendation: accept with revisions, but require the authors to quantify the false-positive rate and explicitly distinguish confirmed attacks from tool detections in the abstract and conclusion.","headline":"A genuinely useful systematization of XS-Leaks with a new postMessage leak and a multi-state attack builder; the 'all 62 vulnerable' headline should be read as tool detections, not confirmed exploits.","tokens_in":27053,"tokens_out":2191,"would_cite":true,"duration_ms":22277,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper argues that cross-origin state inference is not a patchwork of one-off browser bugs but a general, automatable attack class that can distinguish multiple user states across browsers, and demonstrates it with a tool that finds at…","keywords":["cross-origin state inference","XS-Leaks","browser side channels","login detection","deanonymization","web security","attack automation","postMessage leak"],"falsifier":"Create two accounts on a live site that Basta-COSI flags for account deanonymization, one owning the target resource and one not, then load the generated attack page in a clean browser profile while logged in as the non-owner; if the page cannot reliably distinguish the two states across Chrome, Firefox, and Edge, the transfer assumption underlying the reported attack counts is false.","tokens_in":26053,"feed_emoji":"🕵️","tokens_out":9348,"duration_ms":86732,"temperature":0.7,"pith_summary":"This paper makes the case that cross-origin state inference (COSI) attacks are a systematic class of web privacy leak rather than scattered one-off bugs. It claims that by factoring browser leak methods into reusable 'attack classes' and automatically combining multiple attack vectors, an attacker can distinguish more than two user states—such as logged in, reviewer of a paper, or premium account holder—and can do so consistently across Chrome, Firefox, and Edge, where prior work handled at most two states and one browser. To support this, the paper introduces COSI attack classes as a formal 6-tuple, proposes generalization and amplification techniques that turn known attack instances into classes (finding 40, of which 21 are new), and discovers a novel XS-Leak based on window.postMessage. The authors implement these ideas in Basta-COSI, apply it to four web applications and 58 live sites, and report that it finds at least one COSI attack on every target, including login detection on all 62, account deanonymization on 36, SSO status on 12, account type on 5, and access detection on 5. If correct, this means current browsers expose user state at web sites to any page the victim visits, at a scale and level of automation previously not established.","feed_headline":"Automated tool finds user-state leaks on all 62 web targets","feed_subtitle":"Combining browser side channels reveals login status, account type, and ownership across Chrome, Firefox, and Edge.","key_machinery":"The central mechanism is the COSI attack class: a 6-tuple that captures, for a given XS-Leak, the pair of response signatures it can distinguish, the set of inclusion methods (HTML tags and DOM methods) that trigger the leak, and the browsers in which it works. The class is what lets the approach treat 'logged in vs. not' and 'owner vs. non-owner' as interchangeable instances of the same distinguisher. The authors add two discovery techniques on top: generalization, which lifts a known attack instance into a class by finding which response fields actually drive the observable difference, and amplification, which varies inclusion methods and browsers to find new classes. Basta-COSI then combines attack vectors via a greedy set-cover algorithm that scores vectors by how many remaining state-browser pairs they distinguish, producing attack pages that chain vectors such as login detection and reviewer detection to isolate a single target state.","core_discovery":"The central claim is that COSI attacks can be generalized and automated. The authors define a COSI attack class as a 6-tuple specifying the two groups of responses to a state-dependent URL that an XS-Leak can distinguish, the inclusion methods usable with that leak, and the affected browsers. They show that any prior COSI attack instance can be lifted into such a class, and that new classes can be discovered by systematically varying response headers, body, inclusion method, and browser. Applying this to 23 prior works yields 40 attack classes, 19 generalizing known attacks and 21 new, including a postMessage-based leak that affects Chrome, Firefox, and Edge and applies to blogger.com, ebay.com, reddit.com, and youtube.com. Basta-COSI operationalizes the classes: it crawls a target, collects per-state responses, matches SD-URLs to classes, selects a minimal set of attack vectors that cover all state-browser pairs, and emits a working attack page. The paper's headline empirical result is that this pipeline found at least one COSI attack on all 62 targets tested, with the strongest attacks being multi-vector ones such as reviewer deanonymization on HotCRP and account ownership detection on LinkedIn, Blogger, and Pornhub.","pith_inferences":["If the attack-class model is right, XS-Leak discovery becomes a regression-testing problem for browser vendors: each browser update should be checked against the 40 classes, since a class that stops working is a fix and a new one is a potential vulnerability.","The uniform presence of login detection suggests COSI is a structural consequence of ambient authority (cookies sent to any cross-origin request), so durable mitigation is likely to require browser-level defaults rather than per-site patches; the paper's own defense discussion implicitly supports this direction.","The postMessage leak implies that any endpoint whose broadcast messages differ by state is a potential oracle, so systematically diffing message payloads across states—not just counting messages—could uncover further leaks in APIs beyond the 40 classes."],"forward_implications":["Login status leaks on every one of the 62 targets: any site using cookie-based authentication is exposed to at least one XS-Leak, so login detection should be treated as a default condition, not an exceptional bug.","Account deanonymization works on 36 of the 58 live sites, which makes closed-world identification of an account owner—matching one of a small set of known people to a username—practically feasible on those services.","Attack pages must be browser-specific: Chrome, Firefox, and Edge have different affected classes, and Chrome exhibits the largest attack surface in all eight XS-Leaks, so a single universal attack page is unlikely to work everywhere.","The newly discovered postMessage XS-Leak broadens the attack surface to sites that broadcast different messages depending on state, including blogger.com, ebay.com, reddit.com, and youtube.com, on all three major browsers.","Proposed browser-side defenses such as default SameSite=Lax cookies and Cross-Origin-Resource-Policy reduce but do not eliminate COSI: leaks via HTTP authentication credentials, client-side certificates, and the window.open inclusion method remain."],"supporting_citations":[{"why":"It presents the first EventsFired login-detection attack using protected images, from which the EF-CtMismatchImg class is generalized.","marker":"[36]"},{"why":"It introduces the AppCache XS-Leak and its use for login detection, which becomes one of the 40 attack classes.","marker":"[47]"},{"why":"It provides a collaborative enumeration of browser side-channels that supplies several attack classes and their browser coverage, used as a validation baseline.","marker":"[65]"},{"why":"It presents the first timing-based COSI attack, which is the basis for the Timing class and for Basta-COSI's timing support.","marker":"[21]"},{"why":"It demonstrates the CSP violation report leak that defines the CSPViolation attack class.","marker":"[40]"},{"why":"It introduces the JSObjectRead techniques (prototype tampering, global API redefinition) that are incorporated into the JSObjectRead class.","marker":"[50]"},{"why":"It shows deanonymization via leaky images on GitHub, which the present work generalizes to non-image resources.","marker":"[61]"},{"why":"It analyzes privacy issues in broadcast postMessages, providing the basis for the novel postMessage XS-Leak.","marker":"[37]"}],"fun_headline_variants":["Basta-COSI automates state-leak discovery on 62 sites","40 COSI attack classes, one tool, all 62 targets leak","New postMessage leak boosts COSI attacks to 40 classes","Cross-origin state leaks: 40 attack classes, 62 sites affected","Tool finds state leaks on every one of 62 sites tested"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method assumes that a leak observed in a controlled test application behaves identically on live web sites, so a URL whose response matches an attack-class signature will actually leak the user's state in a real browser.","fun_headline_variants_meta":{"raw":{"variants":["Basta-COSI automates state-leak discovery on 62 sites","40 COSI attack classes, one tool, all 62 targets leak","New postMessage leak boosts COSI attacks to 40 classes","Cross-origin state leaks: 40 attack classes, 62 sites affected","Tool finds state leaks on every one of 62 sites tested"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001319,"raw_usage":{"total_tokens":5464,"prompt_tokens":1132,"completion_tokens":4332,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":748,"completion_tokens_details":{"reasoning_tokens":4238}},"tokens_in":748,"tokens_out":4332,"duration_ms":30191,"temperature":1.0,"reasoning_tokens":4238,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:51:19.388545+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Create two accounts on a live site that Basta-COSI flags for account deanonymization, one owning the target resource and one not, then load the generated attack page in a clean browser profile while logged in as the non-owner; if the page cannot reliably distinguish the two states across Chrome, Firefox, and Edge, the transfer assumption underlying the reported attack counts is false.","supporting_citations":[{"cited_title":"Grossman and R","cited_arxiv_id":null,"evidence_quote":"It presents the first EventsFired login-detection attack using protected images, from which the EF-CtMismatchImg class is generalized."},{"cited_title":"Identifying cross-origin resource status using application cache,","cited_arxiv_id":null,"evidence_quote":"It introduces the AppCache XS-Leak and its use for login detection, which becomes one of the 40 attack classes."},{"cited_title":"Vela Nava, L","cited_arxiv_id":null,"evidence_quote":"It provides a collaborative enumeration of browser side-channels that supplies several attack classes and their browser coverage, used as a validation baseline."},{"cited_title":"Exposing private information by timing web applications,","cited_arxiv_id":null,"evidence_quote":"It presents the first timing-based COSI attack, which is the basis for the Timing class and for Basta-COSI's timing support."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It demonstrates the CSP violation report leak that defines the CSPViolation attack class."},{"cited_title":"The unexpected dangers of dynamic javascript,","cited_arxiv_id":null,"evidence_quote":"It introduces the JSObjectRead techniques (prototype tampering, global API redefinition) that are incorporated into the JSObjectRead class."},{"cited_title":"Leaky images: Targeted privacy attacks in the web,","cited_arxiv_id":null,"evidence_quote":"It shows deanonymization via leaky images on GitHub, which the present work generalizes to non-image resources."},{"cited_title":"Privacy breach by exploiting postmessage in html5: Identification, evaluation, and countermeasure,","cited_arxiv_id":null,"evidence_quote":"It analyzes privacy issues in broadcast postMessages, providing the basis for the novel postMessage XS-Leak."}],"review_version":1}