Escaping the Privacy Sandbox with Client-Side Deanonymization Attacks
Eugene Lim demonstrates novel client-side attacks that subvert Google's Privacy Sandbox APIs to deanonymize users and track web browsing histories.
Summary
The Architecture of Google's Privacy Sandbox
Google developed the Privacy Sandbox framework to replace third-party cookies with privacy-preserving APIs (such as Topics, Protected Audience, and Attribution Reporting) designed to support digital advertising without cross-site tracking.
Discovering Information Leaks in Sandbox APIs
Eugene Lim presents a series of novel client-side exploit techniques that chain subtle timing discrepancies, storage side channels, and API state leaks within the Privacy Sandbox implementation.
Cross-Site Tracking and User Deanonymization
By manipulating API query parameters across collaborating domains, an adversary can bypass intentional differential privacy noise, reconstructing individual browsing histories and linking anonymous sessions to real-world identities.
Securing Privacy-Preserving Web Standards
Preventing deanonymization attacks requires browser vendors to mathematically prove noise bounds, enforce strict cross-origin partitioning, and eliminate synchronous side-channel oracles.
Related talks
Main Stage·26 min
Eugene Lim
Eugene Lim demonstrates client-side exploit chains against Google's Privacy Sandbox APIs to defeat differential privacy noise and track web users.
Main Stage·18 min
Ionut Cernica
Ionut Cernica demonstrates novel side-channel attacks against Tor HTTP Onion Services, leaking the real backend IP address through HTTP header discrepancies.
IEEE Symposium on Security and Privacy·19 min
Security researchers examine technical aspects of SurroundWeb: Mitigating Privacy Concerns in a 3D Web Browser.