Pith. sign in

REVIEW 2 major objections 5 minor 69 references

Local Frames: Exploiting Inherited Origins to Bypass Content Blockers

T0 review · 2 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Websites can bypass all six studied content blockers by hiding tracking code and ads inside local frames—iframes with about:blank sources—because the tools misattribute the frames' inherited origin.

desk verdict Real attack, solid tests, vendor patches — but the wild-prevalence numbers overstate exposure. read the letter →

arxiv 2506.00317 v2 pith:XTS6DDE3 submitted 2025-05-31 cs.CR

Alisha Ukani , Hamed Haddadi , Alex C. Snoeren , Peter Snyder This is my paper
classification cs.CR
keywords contentblockerslocalframesabout:blankinheritedoriginfilterliststrackingprotectioncosmeticfilteringprivacytools
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that content blockers systematically mishandle a class of iframe it calls local frames—iframes whose source is not a URL, almost always about:blank—so that content loaded inside them bypasses the protections users rely on. It argues that the HTML standard gives these frames the inherited origin of the document that creates them, but the six tools studied compute frame origin from the source string instead, leading to rules that are not applied, or applied to the wrong frame. The paper reports 19 vulnerabilities across Brave, AdGuard, uBlock Origin Lite, AdBlock Plus, Safari Content Blocking, and DuckDuckGo, and a crawl of nearly 22,000 popular sites showing local frames on 56% of them, with 73.7% of the requests made inside local frames matching filter-list rules that should block them. If the paper is right, many users of these tools are exposed to the fingerprinting, cookie-based tracking, data exfiltration, and ads they believe are blocked, and any measurement or research that decides first- versus third-party status from a frame's URL inherits the same error.

What carries the argument

The central object is the local frame: an iframe with a non-URL source, about:blank in 95.8% of observed cases, which per the HTML specification inherits the origin of the document that creates it. That inherited origin is the load-bearing identity. The paper's tests compare what should happen under filter-list rules with what actually happens in first-party, third-party, and nested local frames, and trace each failure to an origin or party-ness computation that reads the frame's source instead of its inherited security origin. The tests cover four capabilities—request blocking, resource replacement, scriptlet injection, and cosmetic filtering—and are what turn the origin bug into concrete, tool-by-tool vulnerabilities.

What would settle it

Run the paper's public test pages against current releases of the six tools and check whether a request to a known tracker such as doubleclick.net made from an about:blank iframe is blocked, and whether elements selected by a cosmetic filter inside the frame are hidden. If all six tools now block and hide as intended, the paper's central finding no longer describes current software; conversely, a vendor document stating that local frames are intentionally excluded from protections would refute the claim that these are vulnerabilities rather than scoping decisions.

Watch

Extended reading notes

Core claim

The paper's central claim is that content blockers frequently mishandle local frames, allowing content loaded within them to bypass blocker protections. For each capability the paper studies—request blocking, resource replacement, scriptlet injection, and cosmetic filtering—it builds test pages and finds at least one failure in every one of six tools: Brave, AdGuard, uBlock Origin Lite, AdBlock Plus, Safari Content Blocking, and DuckDuckGo. The root cause is origin misattribution: tools derive a frame's origin from its src URL instead of using the inherited origin specified by the HTML standard, so a local frame inside a third-party iframe may be treated as about:blank or as the first-party page. Consequences include unblocked tracking requests in Brave's iOS browser, evasion of scriptlet injection and cosmetic filtering in Brave and AdGuard, cosmetic-filter evasion in uBlock Origin Lite, AdBlock Plus iOS, and Safari Content Blocking, and DuckDuckGo under-reporting blocked trackers. The paper also finds these vulnerabilities are being exercised on real websites, noting that 14.3% of crawled sites make requests inside local frames that should be blocked by popular filter lists.

Load-bearing premise

The load-bearing premise is that a filter-list rule with no frame-type restriction is intended to apply inside about:blank frames; if a vendor deliberately scoped protections away from local frames to avoid breakage, the observed failures would be a design choice rather than a vulnerability.

Editorial extensions

If this is right

  • Websites can bypass request blocking in Brave's iOS browser by issuing AJAX or fetch requests from inside local frames, because the alternative code path Brave built to work around Safari's rule limit miscomputes the request origin.
  • Scriptlet injection and cosmetic filtering can be evaded in Brave and AdGuard, allowing tracking scripts to run and ads to be shown that should be hidden; AdGuard even applies first-party rules to third-party local frames, which can break pages.
  • Cosmetic filtering can be evaded in uBlock Origin Lite, AdBlock Plus iOS, and Safari Content Blocking, so ads placed in local frames stay visible for those users, including users of iOS apps built on Safari's content-blocking API.
  • DuckDuckGo correctly blocks requests in local frames but fails to report blocked trackers to the user when the block happens in a nested local frame, so its privacy-information interface understates what is being blocked.
  • In the crawl, 3,142 of 21,965 sites (14.3%) make requests inside local frames that popular filter lists would block, meaning the vulnerability is being exercised on real, popular websites today, not only in synthetic tests.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The root cause is not specific to filter-list blockers: any web tool that must decide first- versus third-party context from a frame's URL—cookie consent managers, telemetry systems, anti-fingerprinting extensions, or research crawlers—is a candidate for the same misattribution, and the paper's small sample of prior-work code already shows such bugs.
  • A natural hardening step, beyond patching each tool, is a filter-list rule or browser signal that treats a local frame's inherited origin as authoritative for partyness; this could be tested by running the paper's test pages against a patched tool and confirming rules intended for the parent now apply inside local frames.
  • If about:blank becomes safe after widespread patching, evaders may shift to other inherited-origin or opaque-origin sources such as about:srcdoc, blob, and data URLs, which the paper found in only a small fraction of frames but did not test exhaustively.
  • The paper's breakage check was limited to 50 sites, so the real-world cost of enforcing rules inside local frames—especially the risk of first-party rules leaking into third-party frames, which AdGuard already exhibited—remains an open empirical question.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper studies 'local frames' (iframes whose source is a non-URL URI such as about:blank or about:srcdoc) and argues that six widely used content-blocking tools—AdBlock Plus, AdGuard, uBlock Origin Lite, Brave, DuckDuckGo, and Safari Content Blocking—mishandle the inherited origins of these frames. The authors design tests for four capabilities (request blocking, resource replacement, scriptlet injection, and cosmetic filtering), identify what they count as 19 distinct vulnerabilities across the tools, and supplement the tests with source-code analysis and vendor disclosures. They also crawl 21,965 Tranco-ranked sites with PageGraph, report that 55.7% of crawled sites contain local frames, and claim that 73.7% of requests made inside local frames should be blocked by EasyList/EasyPrivacy/uBlock Origin filter lists and are not blocked by vulnerable tools. Vendor acknowledgments and patches are reported for Brave, Safari, AdGuard, and DuckDuckGo.

Significance. If the per-tool results stand, this is a valuable and timely empirical contribution. The paper identifies a real root cause—tools deriving an iframe's origin from its URL rather than from the inherited-origin rules of the HTML specification—and demonstrates concrete bypasses in products with large user bases. The work is strengthened by the use of specific tool versions, direct behavioral tests, source-code analysis for the Brave and DuckDuckGo findings, public test pages and data, and responsible disclosure with vendor patches that corroborate the main per-tool conclusions. The measurement of local-frame prevalence is also useful, though the headline 73.7%/14.3% figures overstate what the measurement actually shows. The paper's central vulnerability claims are defensible, but the measurement section needs to be aligned with the per-tool evidence before the paper should appear in final form.

major comments (2)
  1. [§3.2.3, Table 3, Abstract] The headline measurement claim is not supported by the methodology. The crawl uses the adblock-rs matcher against the union of EasyList, EasyPrivacy, and uBlock Origin lists; it does not run any of the six tested tools on the crawled pages. The tested vulnerabilities are capability- and platform-specific: DuckDuckGo correctly blocks requests in local frames (§4.4.5), uBlock Origin Lite's local-frame failure is cosmetic filtering rather than request blocking (§4.4.2), and Brave iOS's request-blocking bypass applies to a reduced 'slim list' path (§4.4.4). A request matching the full list union therefore would not necessarily be blocked by any vulnerable tool even outside a local frame. The Abstract's '73.7% of the requests made by these local frames should be blocked by popular filter lists but instead trigger the vulnerabilities we identify' conflates filter-list coverage with demonstrable exposure under a specific tool. Please either run each vulnerable tool's engine over the crawled requests (or a representative sample) and report per-tool exposure, or rephrase the 73.7% and 14.3% claims as statements about filter-list matches only, and adjust the Introduction's 'majority of popular websites are currently doing such evasion' accordingly.
  2. [§4.1, §4.4.2] The operational definition of vulnerability—'a rule that is intended to be applied to a local frame is not applied'—presumes that the absence of a frame-type restriction in a filter-list rule indicates the tool intends to apply that rule inside local frames. Vendor acknowledgments and patches support this reading for most tools, and the paper states in §6.4 that all organizations called the failures unintentional. However, uBlock Origin Lite's maintainer explicitly declined to fix the cosmetic-filtering gap because of performance overhead, which is more consistent with an accepted scoping decision or trade-off than with an origin-computation bug. Please classify the uBlock Origin Lite cosmetic-filtering case separately (for example, as a known limitation with a vendor-accepted rationale) or provide evidence from the maintainer that the behavior is unintended; otherwise the '19 vulnerabilities' count mixes two different kinds of findings.
minor comments (5)
  1. [§3.2.3] State the exact retrieval date (and, where applicable, commit hashes) for the EasyList, EasyPrivacy, and uBlock Origin filter lists used in the adblock-rs analysis; Section 2.2.1 gives a date for rule counts, but the crawl post-processing should cite the list versions it used.
  2. [Table 5 and Table 6] The paper claims 19 vulnerabilities but does not enumerate them. Add a mapping from each table cell (tool, platform, capability) to a vulnerability identifier, and make the legend for the symbols in Table 5 explicit; the symbols are not legible in the text version and the count cannot currently be verified.
  3. [§4.4.1 and §4.4.2] For the 'inconsistently effective' scriptlet results in AdBlock Plus and uBlock Origin, report how often the race condition occurred across repeated runs and under what conditions (e.g., page load timing), so readers can judge the practical exploitability.
  4. [§4.4.4] When describing the Brave iOS request-blocking test, specify the exact 'slim list' version and the rule used for /ads/index, and clarify whether the same bypass would apply to requests that match the full EasyList/EasyPrivacy sets; the current text leaves the reader unsure which set of requests is actually at risk.
  5. [§6.4] The breakage evaluation is a pilot rather than a general result: 50 sampled sites and two testers, with the two observed breakages being inconsistent and not local-frame-related. Please describe it as a preliminary check and avoid wording that implies a broad 'no breakage' conclusion.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper's vulnerability claims are direct empirical conformance tests, and the criticized 73.7% figure is an external-validity concern rather than a self-referential derivation.

full rationale

This paper is an empirical conformance study, not a derivation chain, and I find no step where a result is equivalent to its inputs by construction. The central claim that content blockers mishandle local frames is supported by direct, observable tests: the authors define filter-list rules, place requests or elements inside local frames, and check whether the tool applies the rule. The expected behavior is grounded in the HTML specification's inherited-origin rule and in the tools' own filter-list semantics, not in the outcome being claimed. Specifically, Section 4.1's definition of a bypass ('a rule that is intended to be applied to a local frame is not applied') is an operational criterion for conformance testing, and the per-tool results in Section 4.4 are observed behaviors, not quantities fitted from the data. The 73.7% and 14.3% measurement figures are computed by matching local-frame requests against EasyList, EasyPrivacy, and uBlock Origin lists with adblock-rs; this may overstate real user exposure because the crawl does not run each vulnerable tool's engine and the vulnerabilities are capability- and platform-specific. However, that is a generalizability or external-validity criticism, not circularity: the filter lists are third-party ground truth, and no fitted parameter is renamed as a prediction. The authors' affiliation with Brave, which maintains PageGraph and adblock-rs, is a potential conflict-of-interest consideration, but those tools are measurement infrastructure and the core vulnerability findings were independently confirmed by vendor patches and acknowledgments. No self-citation is load-bearing in the argument, and no uniqueness theorem or ansatz is smuggled in via citation. I therefore find no significant circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper contributes a measurement and vulnerability study rather than a model with free parameters. Its claims rest on web platform semantics (inherited origin), the intent of filter-list rules, and the accuracy of the crawler and filter-list ground truth, listed above. No new entities are postulated.

assumptions (4)
  • domain assumption An about:blank iframe inherits the origin of the document that creates it, per the HTML specification.
    Invoked in Section 2.1.1 and Listing 1; this inheritance is the basis for saying a local frame 'should' be treated as first-party or third-party by content blockers. It is a spec claim, not proven in the paper.
  • domain assumption When a filter-list rule is configured without a frame-type restriction, the tool intends that rule to apply inside local frames.
    Section 4.1 defines a bypass as a rule intended for a local frame not being applied; this presumes the tools' intent. Vendor acknowledgments and patches support it, but the test itself cannot distinguish non-application from deliberate scoping.
  • domain assumption The PageGraph crawler's event attribution correctly identifies frames, their origins, and the source of network requests.
    Section 3.1.2; the prevalence and 'should be blocked' numbers depend on this attribution being correct.
  • domain assumption EasyList, EasyPrivacy, and uBlock Origin's additional filter lists, applied via adblock-rs, define what 'should be blocked' means.
    Section 3.2.3; this operationalizes the ground truth, but tool-specific rule sets and exceptions could change the counts.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Local Frames: Exploiting Inherited Origins to Bypass Content Blockers." pith.science (2026). https://pith.science/paper/XTS6DDE3

@misc{pith2026250600317,
  author       = {Pith},
  title        = {Pith review of: Local Frames: Exploiting Inherited Origins to Bypass Content Blockers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XTS6DDE3}},
  note         = {Machine review of arXiv:2506.00317}
}
read the original abstract

We present a study of how local frames (i.e., iframes loading content like "about:blank") are mishandled by a wide range of popular Web security and privacy tools. As a result, users of these tools remain vulnerable to the very attack techniques against which they seek to protect themselves, including browser fingerprinting, cookie-based tracking, and data exfiltration. The tools we study are vulnerable in different ways, but all share a root cause: legacy Web functionality interacts with browser privacy boundaries in unexpected ways, leading to systemic vulnerabilities in tools developed, maintained, and recommended by privacy experts and activists. We consider four core capabilities supported by most privacy tools and develop tests to determine whether each can be evaded through the use of local frames. We apply our tests to six popular Web privacy and security tools -- identifying at least one vulnerability in each for a total of 19 -- and extract common patterns regarding their mishandling of local frames. Our measurement of popular websites finds that 56% employ local frames and that 73.7% of the requests made by these local frames should be blocked by popular filter lists but instead trigger the vulnerabilities we identify. From another perspective, 14.3% of all sites that we crawl make requests that should be blocked inside of local frames. We disclosed these vulnerabilities to the tool authors and discuss both our experiences working with them to patch their products and the implications of our findings for other privacy and security research.

Figures

Figures reproduced from arXiv: 2506.00317 by the authors.

Figure 1
Figure 1. Structure of the test website for blocking requests and the expected behavior for RQ1. [PITH_FULL_IMAGE:figures/full_fig_p006_1.png] view at source ↗
Figure 2
Figure 2. Structure of the test website for resource replacement (a) before and (b) after AJAX request execution, and (c) the [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Representation of (a) our test website for cosmetic filtering and (b) the expected behavior for RQ4. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Structure of our test website for blocking requests. [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Expected behavior for blocking first-party requests. [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

69 extracted references · 69 canonical work pages

  1. [1]

    Introduction to Filter Lists

    AdBlock. Introduction to Filter Lists. https://helpcenter.getadblock.com/hc/en- us/articles/9738523403027-Introduction-to-Filter-Lists. Accessed 2024-09-03

    work page arXiv 2024

  2. [2]

    https://github.com/AdguardTeam/Scriptlets/blob/master/wi ki/about-scriptlets.md

    Available Scriptlets. https://github.com/AdguardTeam/Scriptlets/blob/master/wi ki/about-scriptlets.md. Accessed 2024-08-21

    work page 2024

  3. [3]

    https://adguard.com/kb/general/ad- filtering/create-own-filters

    How to create your own ad filters. https://adguard.com/kb/general/ad- filtering/create-own-filters. Accessed 2024-08-30

    work page 2024

  4. [4]

    Safari Web extension

    AdGuard. Safari Web extension. https://adguard.com/kb/adguard-for-ios/web- extension/. Setup instructions for the AdGuard iOS app. Accessed 2024-09-04

    work page 2024

  5. [5]

    https://github.com/AdguardTeam/tsurlfilter/commit/277790f47 86f017c0f4f552795c13627dbee1f66

    Commit 277790f. https://github.com/AdguardTeam/tsurlfilter/commit/277790f47 86f017c0f4f552795c13627dbee1f66

    work page

  6. [6]

    TrackerSift: Untangling Mixed Tracking and Functional Web Resources

    Abdul Haddi Amjad, Danial Saleem, Muhammad Ali Gulzar, Zubair Shafiq, and Fareed Zaffar. TrackerSift: Untangling Mixed Tracking and Functional Web Resources. In Proceedings of the 21st ACM Internet Measurement Conference , 2021

    work page 2021

  7. [7]

    adblock-rs

    Anton Lazarev, Brave Software. adblock-rs. https://github.com/brave/adblock- rust. Rust library for parsing and applying filter list rules. Accessed 2024-09-03

    work page 2024

  8. [8]

    Creating a content blocker

    Apple. Creating a content blocker. https://developer.apple.com/documentation/ safariservices/creating-a-content-blocker. Accessed 2024-08-20

    work page 2024

Show all 69 references
  1. [9]

    EasyList

    EasyList Authors. EasyList. https://easylist.to/easylist/easylist.txt

  2. [10]

    EasyPrivacy

    EasyList Authors. EasyPrivacy. https://easylist.to/easylist/easyprivacy.txt

  3. [11]

    How Tracking Companies Circumvented Ad Blockers Using WebSockets

    Muhammad Ahmad Bashir, Sajjad Arshad, Engin Kirda, William Robertson, and Christo Wilson. How Tracking Companies Circumvented Ad Blockers Using WebSockets. In Proceedings of the 18th ACM Internet Measurement Conference , 2018

    2018

  4. [12]

    pagegraph-crawl

    Brave. pagegraph-crawl. https://github.com/brave/pagegraph-crawl

  5. [13]

    https://github.c om/brave/brave-core/pull/26622

    fix(privacy): Issues with content filtering in local frames on iOS. https://github.c om/brave/brave-core/pull/26622

  6. [14]

    https://www.charlesproxy.com/

    Charles Web Debugging Proxy. https://www.charlesproxy.com/

  7. [15]

    Detecting Filter List Evasion With Event-Loop-Turn Granularity JavaScript Signatures

    Quan Chen, Peter Snyder, Ben Livshits, and Alexandros Kapravelos. Detecting Filter List Evasion With Event-Loop-Turn Granularity JavaScript Signatures. In Proceedings of the 42nd IEEE Symposium on Security and Privacy , 2021

    2021

  8. [16]

    Alternative to third-party cookies: Investigating persistent PII leakage-based web tracking

    Ha Dao and Kensuke Fukuda. Alternative to third-party cookies: Investigating persistent PII leakage-based web tracking. In Proceedings of the 17th International Conference on emerging Networking EXperiments and Technologies , 2021

    2021

  9. [17]

    What I Learned at Work this Week: Friendly IFrames and Debounce

    Mike Diaz. What I Learned at Work this Week: Friendly IFrames and Debounce. Medium, 2020. Accessed 2024-12-27

    2020

  10. [18]

    android-tds.json

    DuckDuckGo. android-tds.json. https://github.com/duckduckgo/tracker-blocklis ts/blob/3ea4fbb7821f4bb0065722dfae4f4c9d63a1266d/web/v5/android-tds.json. DuckDuckGo blocklist for the Android platform. Accessed 2024-09-03

    2024

  11. [19]

    extension-tds.json

    DuckDuckGo. extension-tds.json. https://github.com/duckduckgo/tracker-bl ocklists/blob/3ea4fbb7821f4bb0065722dfae4f4c9d63a1266d/web/v6/extension- tds.json. DuckDuckGo blocklist for browser extensions. Accessed 2024-09-03

    2024

  12. [20]

    ios-tds.json

    DuckDuckGo. ios-tds.json. https://github.com/duckduckgo/tracker-blockl ists/blob/3ea4fbb7821f4bb0065722dfae4f4c9d63a1266d/web/v5/ios-tds.json. DuckDuckGo blocklist for the iOS platform. Accessed 2024-09-03

    2024

  13. [21]

    macos-tds.json

    DuckDuckGo. macos-tds.json. https://github.com/duckduckgo/tracker-blocklis ts/blob/3ea4fbb7821f4bb0065722dfae4f4c9d63a1266d/web/v6/macos-tds.json. DuckDuckGo blocklist for the macOS platform. Accessed 2024-09-03

    2024

  14. [22]

    https: //github.com/duckduckgo/BrowserServicesKit/pull/1021

    Change tab URL calculation for contentblockerrules.js and surrogates.js. https: //github.com/duckduckgo/BrowserServicesKit/pull/1021

  15. [23]

    Online Tracking: A 1-million-site Mea- surement and Analysis

    Steven Englehardt and Arvind Narayanan. Online Tracking: A 1-million-site Mea- surement and Analysis. In Proceedings of the 23rd ACM Conference on Computer and Communications Security, 2016

    2016

  16. [24]

    https://github.com/fingerprintjs/fingerprintjs

    FingerprintJS. https://github.com/fingerprintjs/fingerprintjs

  17. [25]

    Content scripts

    Chrome for Developers. Content scripts. https://developer.chrome.com/docs/ex tensions/develop/concepts/content-scripts. Accessed 2024-08-30. CCS ’25, October 13–17, 2025, Taipei, Taiwan Alisha Ukani, Hamed Haddadi, Alex C. Snoeren, and Peter Snyder

    2024

  18. [26]

    Report shows that Safari reaches one billion worldwide users, still behind Google Chrome

    Lauren Forristal. Report shows that Safari reaches one billion worldwide users, still behind Google Chrome. TechCrunch, 2022. Accessed 2025-01-06

    2022

  19. [27]

    Viewability best practices

    Google. Viewability best practices. https://support.google.com/admanager/ans wer/6199883?hl=en. Accessed 2024-12-27

    2024

  20. [28]

    What is rich media? https://support.google.com/richmedia/answer/2417 545?hl=en

    Google. What is rich media? https://support.google.com/richmedia/answer/2417 545?hl=en. Accessed 2024-12-27

    2024

  21. [29]

    Private communication

    Raymond Hill. Private communication

  22. [30]

    Rich Media Measurement Guidelines

    Interactive Advertising Bureau (IAB). Rich Media Measurement Guidelines. https://www.iab.com/wp-content/uploads/2015/06/Rich_Media_Measurement _Guidelines_v2.pdf, 2007. Accessed 2024-08-29

    2015

  23. [31]

    Best Practices for Rich Media Ads in Asynchronous Ad Environments

    Interactive Advertising Bureau (IAB). Best Practices for Rich Media Ads in Asynchronous Ad Environments. https://www.iab.com/wp-content/uploads/20 15/09/rich_media_ajax_best_practices.pdf, oct 2008. Accessed 2024-08-29

    2008

  24. [32]

    Entity List

    Disconnect Inc. Entity List. https://github.com/mozilla-services/shavar-prod-list s/blob/02f6a2835a851fd92d3f996409cfd18c2d4b0a2b/disconnect-entitylist.json,

  25. [33]

    Fingerprinting the Finger- printers: Learning to Detect Browser Fingerprinting Behaviors

    Umar Iqbal, Steven Englehardt, and Zubair Shafiq. Fingerprinting the Finger- printers: Learning to Detect Browser Fingerprinting Behaviors. In Proceedings of the 42nd IEEE Symposium on Security and Privacy , 2021

    2021

  26. [34]

    The Ad Wars: Retrospective Mea- surement and Analysis of Anti-Adblock Filter Lists

    Umar Iqbal, Zubair Shafiq, and Zhiyun Qian. The Ad Wars: Retrospective Mea- surement and Analysis of Anti-Adblock Filter Lists. In Proceedings of the 17th ACM Internet Measurement Conference, 2017

    2017

  27. [35]

    AdGraph: A Graph-Based Approach to Ad and Tracker Blocking

    Umar Iqbal, Peter Snyder, Shitong Zhu, Benjamin Livshits, Zhiyun Qian, and Zubair Shafiq. AdGraph: A Graph-Based Approach to Ad and Tracker Blocking. In Proceedings of the 41st IEEE Symposium on Security and Privacy , 2020

    2020

  28. [36]

    Towards Realistic and Reproducible Web Crawl Measurements

    Jordan Jueckstock, Shaown Sarker, Peter Snyder, Aidan Beggs, Panagiotis Pa- padopoulos, Matteo Varvello, Benjamin Livshits, and Alexandros Kapravelos. Towards Realistic and Reproducible Web Crawl Measurements. In Proceedings of the 30th ACM Web Conference, 2021

    2021

  29. [37]

    Measuring the Privacy vs

    Jordan Jueckstock, Peter Snyder, Shaown Sarker, Alexandros Kapravelos, and Benjamin Livshits. Measuring the Privacy vs. Compatibility Trade-off in Prevent- ing Third-Party Stateful Tracking. In Proceedings of the 31st ACM Web Conference, 2022

    2022

  30. [38]

    AutoFR: Automated Filter Rule Generation for Adblocking

    Hieu Le, Salma Elmalaki, Athina Markopoulou, and Zubair Shafiq. AutoFR: Automated Filter Rule Generation for Adblocking. In Proceedings of the 32nd USENIX Security Symposium, 2023

    2023

  31. [39]

    Manifest V2 phase-out begins

    David Li. Manifest V2 phase-out begins. Chromium Blog, May 2024. Accessed 2024-08-20

    2024

  32. [40]

    https://developer.mozilla.org/en-US/docs/Web/Security/Sam e-origin_policy

    Same-origin policy. https://developer.mozilla.org/en-US/docs/Web/Security/Sam e-origin_policy. Accessed 2024-08-25

    2024

  33. [41]

    The "about" URI Scheme

    S Moonesamy. The "about" URI Scheme. RFC 6694, August 2012

    2012

  34. [42]

    Extensions in Privacy & Security

    Mozilla. Extensions in Privacy & Security. https://addons.mozilla.org/en- US/firefox/extensions/category/privacy-security/?page=1&sort=recommende d%2Cusers. Accessed 2025-01-08

    2025

  35. [43]

    Firefox Public Data Report

    Mozilla. Firefox Public Data Report. https://data.firefox.com/dashboard/usage- behavior. Accessed 2025-01-08

    2025

  36. [44]

    Detecting Anti Ad-blockers in the Wild

    Muhammad Haris Mughees and Zhiyun Qian. Detecting Anti Ad-blockers in the Wild. In Proceedings on Privacy Enhancing Technologies , volume 3, 2017

    2017

  37. [45]

    Breaking the Shield: Analyzing and Attacking Canvas Fingerprinting Defenses in the Wild

    Hoang Dai Nguyen and Phani Vadrevu. Breaking the Shield: Analyzing and Attacking Canvas Fingerprinting Defenses in the Wild. In Proceedings of the 34th ACM Web Conference, 2025

    2025

  38. [46]

    Defining "Broken": User Experiences and Remediation Tactics When Ad-Blocking or Tracking-Protection Tools Break a Website’s User Experience

    Alexandra Nisenoff, Arthur Borem, Madison Pickering, Grant Nakanishi, Maya Thumpasery, and Blase Ur. Defining "Broken": User Experiences and Remediation Tactics When Ad-Blocking or Tracking-Protection Tools Break a Website’s User Experience. In Proceedings of the 32nd USENIX S...

    2023

  39. [47]

    Adblocking and Counter-Blocking: A Slice of the Arms Race

    Rishab Nithyanand, Sheharbano Khattak, Mobin Javed, Narseo Vallina-Rodriguez, Marjan Falahrastegar, Julia E Powles, Emiliano De Cristofaro, Hamed Haddadi, and Steven J Murdoch. Adblocking and Counter-Blocking: A Slice of the Arms Race. In Proceedings of the 6th USENIX Workshop...

    2016

  40. [48]

    AdGuard v1.11 for Safari: Fight for filtering rule limits

    Sofia Orlova. AdGuard v1.11 for Safari: Fight for filtering rule limits. AdGuard Blog, March 2022. Accessed 2024-09-03

    2022

  41. [49]

    uBlock Origin

    Raymond Hill. uBlock Origin. https://github.com/gorhill/uBlock. An efficient blocker for Chromium and Firefox. Accessed 2024-09-03

    2024

  42. [50]

    Types of iFrames and When to Use Them

    Human Security. Types of iFrames and When to Use Them. https://www.huma nsecurity.com/learn/topics/types-of-iframes-and-when-to-use-them. Accessed 2024-12-27

    2024

  43. [51]

    WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking

    Sandra Siby, Umar Iqbal, Steven Englehardt, Zubair Shafiq, and Carmela Troncoso. WebGraph: Capturing Advertising and Tracking Information Flows for Robust Blocking. In Proceedings of the 31st USENIX Security Symposium , 2022

    2022

  44. [52]

    Blocked or Broken? Automatically Detecting When Privacy Interventions Break Websites

    Michael Smith, Peter Snyder, Moritz Haller, Benjamin Livshits, Deian Stefan, and Hamed Haddadi. Blocked or Broken? Automatically Detecting When Privacy Interventions Break Websites. In Proceedings on Privacy Enhancing Technologies , volume 4, 2022

    2022

  45. [53]

    Most Websites Don’t Need to Vibrate: A Cost–Benefit Approach to Improving Browser Security

    Peter Snyder, Cynthia Taylor, and Chris Kanich. Most Websites Don’t Need to Vibrate: A Cost–Benefit Approach to Improving Browser Security. InProceedings of the 24th ACM Conference on Computer and Communications Security , 2017

    2017

  46. [54]

    Who Filters the Filters: Under- standing the Growth, Usefulness and Efficiency of Crowdsourced Ad Blocking

    Peter Snyder, Antoine Vastel, and Ben Livshits. Who Filters the Filters: Under- standing the Growth, Usefulness and Efficiency of Crowdsourced Ad Blocking. Proceedings of the ACM on Measurement and Analysis of Computing Systems , 4(2), 2020

    2020

  47. [55]

    Platform Stats & Token Activity

    Brave Software. Platform Stats & Token Activity. https://brave.com/transparen cy/. Accessed 2025-01-06

    2025

  48. [56]

    Slim List System

    Brave Software. Slim List System. https://github.com/brave/slim-list-lambda

  49. [57]

    Adblock Plus - Chrome Web Store

    Chrome Web Store. Adblock Plus - Chrome Web Store. https://chromewebstore .google.com/detail/adblock-plus-free-ad-bloc/cfhdojbkjhnklbpkdaibdccddilif ddb. Accessed 2024-08-19

    2024

  50. [58]

    AdGuard AdBlocker - Chrome Web Store

    Chrome Web Store. AdGuard AdBlocker - Chrome Web Store. https://chromewe bstore.google.com/detail/adguard-adblocker/bgnkhhnnamicmpeenaelnjfhikgb kllg. Accessed 2024-08-19

    2024

  51. [59]

    Privacy & Security

    Chrome Web Store. Privacy & Security. https://chromewebstore.google.com/ca tegory/extensions/make_chrome_yours/privacy. Accessed 2025-01-08

    2025

  52. [60]

    uBlock Origin - Chrome Web Store

    Chrome Web Store. uBlock Origin - Chrome Web Store. https://chromewebstore .google.com/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm. Accessed 2024-08-19

    2024

  53. [61]

    uBlock Origin Lite - Chrome Web Store

    Chrome Web Store. uBlock Origin Lite - Chrome Web Store. https://chromewebs tore.google.com/detail/ublock-origin-lite/ddkjiahejlhfcafbddmgiahcphecmpfh. Accessed 2024-08-20

    2024

  54. [62]

    WebRanz: Web Page Randomization for Better Advertisement Delivery and Web-Bot Prevention

    Weihang Wang, Yunhui Zheng, Xinyu Xing, Yonghwi Kwon, Xiangyu Zhang, and Patrick Eugster. WebRanz: Web Page Randomization for Better Advertisement Delivery and Web-Bot Prevention. In Proceedings of the 24th ACM SIGSOFT International Symposium on Foundations of Software Enginee...

    2016

  55. [63]

    HTML Standard

    WHATWG. HTML Standard. https://html.spec.whatwg.org/commit-snapshots/ c974c42b8bbc3b04cba372f0088fad503be3cc04/. Accessed 2024-08-29

    2024

  56. [64]

    Analyzing the (In)Accessibility of Online Advertisements

    Christina Yeung, Tadayoshi Kohno, and Franziska Roesner. Analyzing the (In)Accessibility of Online Advertisements. In Proceedings of the 24th ACM Internet Measurement Conference, 2024

    2024

  57. [65]

    Comparative Privacy Analysis of Mobile Browsers

    Ahsan Zafar and Anupam Das. Comparative Privacy Analysis of Mobile Browsers. In Proceedings of the 13th ACM Conference on Data and Application Security and Privacy, 2023

    2023

  58. [66]

    Understanding the Privacy Implications of Adblock Plus’s Acceptable Ads

    Ahsan Zafar, Aafaq Sabir, Dilawer Ahmed, and Anupam Das. Understanding the Privacy Implications of Adblock Plus’s Acceptable Ads. In Proceedings of the ACM Asia Conference on Computer and Communications Security , 2021

    2021

  59. [67]

    Adscraper: A Web Crawler for Measuring Online Ad Content

    Eric Zeng. Adscraper: A Web Crawler for Measuring Online Ad Content

  60. [68]

    party-ness

    Shitong Zhu, Xunchao Hu, Zhiyun Qian, Zubair Shafiq, and Heng Yin. Measur- ing and Disrupting Anti-Adblockers Using Differential Execution Analysis. In Proceedings of the 25th Network and Distributed System Security Symposium , 2018. A Fingerprinting APIs We classify a fingerp...

    2018

  61. [2024]

    Accessed 2025-05-03; last updated 2025-04-25

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.