PhD Position F/M Detecting Dangerous Browser Extensions to Protect the Security and Privacy of Web Users

Context
The PhD position is funded by the French National Research Agency (ANR). It is part of Aurore Fass' ANR JCJC project "EXPELLIARMUS: Disarming Dangerous Browser Extensions to Protect the Security and Privacy of Web Users".
EXPELLIARMUS, aims to develop methods to "disarm" dangerous extensions to better protect the security and privacy of Web users. More specifically, it will detect, understand, and mitigate dangerous browser extensions through an interdisciplinary approach combining computer science, human factors, and legal analysis. EXPELLIARMUS will deliver a systematic taxonomy of dangerous extension behaviors, open-source datasets and detection tools, as well as actionable recommendations for users, browser vendors, developers, and regulators.
The PhD student will be part of the
research team led by Dr. Nataliia Bielova
(
https://www-sop.inria.fr/members/Nataliia.Bielova/index.html
)
at the
Inria Centre at Université Côte d’Azur at the French Riviera. The PhD student will be
supervised by Dr.-Ing. Aurore Fass
(
https://aurore54f.github.io/
). Note that a PhD in France typically lasts 3 years.
Assignment
Context on Browser Extension Security
Given the central role of the Web in our daily lives and its overall impact on society and economy, it is crucial that Web pages and browser extensions assure the security and privacy of their large user base.
Browser extensions have become an integral part of the modern Web ecosystem. The most popular desktop browser Chrome lists 280k browser extensions [1] (totaling almost 3 billion active users) in its official gallery, the Chrome Web Store [
2
]. Browser extensions enable users to enhance and customize their browsing experience: typically, extensions offer additional functionality to Web users, such as ad blocking (e.g., AdBlock), grammar checks (e.g., Grammarly), or password management (e.g., LastPass). To operate, browser extensions need elevated privileges compared to Web pages. Browser extensions can access sensitive user data, such as cookies or browsing history, and they can interact with arbitrary websites and other extensions [3, 4, 5]. While a compromised or malicious Web page is in itself troublesome, a malicious or vulnerable browser extension is much more powerful, as an attacker can leverage an extension's elevated privileges to cause more harm [3]. In particular, browser extensions can exfiltrate sensitive user data [6], track users online [7], or propagate unwanted software [8]. Detecting such threats at scale remains a challenge, as the extension ecosystem is particularly large, diverse, and continuously evolving.
Limitations of existing work
Abundant prior work attempted to detect some classes of dangerous extensions [9], e.g., malicious [10], vulnerable [3], or fingerprintable extensions [11]. However, related works have major limitations. Existing works analyze only hundreds of extensions [12], are outdated (e.g., 2012–2015 [8, 13, 14, 15]), have limited scalability and necessitate significant manual effort [16, 4], lack a clear characterization of what a dangerous behavior is [14]; and finally, only a small minority thereof is open source, as we have highlighted in [1
0
]. Besides, existing machine learning-based detectors are opaque, they lack interpretability and explainability.
It is therefore critical to design automated, large-scale, and reliable security and privacy analyses of browser extensions that have the potential to be deployed in the real world.
References
:
[1] chrome-stats. Chrome extension statistics.
https://chrome-stats.com/chrome/stats
[2] Google. Chrome Web Store.
https://chromewebstore.google.com
[3]
Aurore Fass
, Dolière Francis Somé, Michael Backes, and Ben Stock. DoubleX: Statically Detecting Vulnerable Data Flows in Browser Extensions at Scale. In ACM CCS, 2021. Code repository:
https://github.com/Aurore54F/DoubleX
[4] Dolière Francis Somé. Empoweb: Empowering web applications with browser extensions. In IEEE S&P, 2019.
[5] Jianjia Yu, Song Li, Junmin Zhu, and Yinzhi Cao. Coco: Efficient browser extension vulnerability detection via coverage-guided, con- current abstract interpretation. In ACM CCS, 2023.
[6] Quan Chen and Alexandros Kapravelos. Mystique: Uncovering information leakage from browser extensions. In ACM CCS, 2018.
[7] Michael Weissbacher, Enrico Mariconti, Guillermo Suarez-Tangil, Gianluca Stringhini, William Robertson, and Engin Kirda. Ex-ray: Detection of history-leaking browser extensions. In ACSAC, 2017.
[8] Xinyu Xing, Wei Meng, Byoungyoung Lee, Udi Weinsberg, Anmol Sheth, Roberto Perdisci, and Wenke Lee. Understanding malvertising through ad-injecting browser extensions. In TheWebConf, 2015.
[9] Sheryl Hsu, Manda Tran, and
Aurore Fass
. What is in the Chrome Web Store? Investigating Security-Noteworthy Browser Extensions. In ACM AsiaCCS, 2024.
[10] Ben Rosenzweig, Valentino Dalla Valle, Giovanni Apruzzese, and
Aurore Fass
. It's not easy: Applying supervised machine learning to detect malicious extensions in the chrome web store. In ACM Transactions
on the Web (TWEB), 2026. Code repository:
https://github.com/its-not-easy/tweb25/tree/main
[11] Shubham Agarwal,
Aurore Fass
, and Ben Stock. Peeking through the window: Fingerprinting browser extensions through page-visible execution traces and interactions. In ACM CCS, 2024. Code repository:
https://github.com/raider-ext/raider
[12] Nicholas Carlini, Adrienne Porter Felt, and David Wagner. An evaluation of the google chrome extension security architecture. In USENIX Security, 2012.
[13] Nav Jagpal, Eric Dingle, Jean-Philippe Gravel, Panayiotis Mavrommatis, Niels Provos, Moheeb Abu Rajab, and Kurt Thomas. Trends and lessons from three years fighting malicious extensions. In USENIX Security, 2015.
[14] Alexandros Kapravelos, Chris Grier, Neha Chachra, Christopher Kruegel, Giovanni Vigna, and Vern Paxson. Hulk: Eliciting malicious behavior in browser extensions. In USENIX Security, 2014.
[15] Kurt Thomas, Elie Bursztein, Chris Grier, Grant Ho, Nav Jagpal, Alexandros Kapravelos, Damon Mccoy, Antonio Nappa, Vern Paxson, Paul Pearce, Niels Provos, and Moheeb Abu Rajab. Ad injection at scale: Assessing deceptive advertisement modifications. In IEEE S&P, 2015.
[16] Nikolaos Pantelaios, Nick Nikiforakis, and Alexandros Kapravelos. You’ve changed: Detecting malicious browser extensions through their update deltas. In ACM CCS, 2020.
Main activities
Objectives of the PhD
The broad objective of this PhD is to
develop new automated tools to detect dangerous browser extensions
, with a specific focus on malicious extensions. While the majority of prior work focuses on Chrome, we also want to study dangerous extensions on other browsers, such as Firefox and Edge, since we showed that the same malicious extensions can be published on multiple galleries [1].
-
Objective 1
: Generate a large-scale dataset of browser extensions. Establish a systematic and comprehensive taxonomy of dangerous browser extension behaviors.
-
Objective 2
: Design novel, automated, and explainable methods to detect dangerous browser extensions, combining JavaScript static and lightweight dynamic analyses, predictive machine learning, and Large-Language Models. Provide interpretable and continuously adaptable detection models.
-
Objective 3
(in collaboration with a postdoctoral researcher, to be recruited): Assess how different stakeholders (i.e., platform maintainers, developers, and users) understand and manage the underlying security and privacy risks of browser extensions.
Keywords
: Web Security & Privacy, Browser Extensions, Dangerous Behavior Detection, Code Analysis, Applied Machine Learning, (Human Factors).
References
:
[1] Abdullah Hassan Chaudhry, Valentino Dalla Valle, and
Aurore Fass
. Two Heads are Better Than One: Analysing Browser Extensions Across Stores. In MADWeb (workshop co-located with NDSS), 2026. Code
repository:
https://github.com/abdchau/two-heads-are-better
Skills
Skills
: A successful candidate for a PhD:
should have a strong background in
Computer Science
(
Master degree
or equivalent);
with a major ideally in
Cybersecurity
;
their research interests should be in
Web Security, Web Privacy, or Web Measurements
.
We are looking for a
motivated
student with:
solid programming skills in
python
;
(at least) a basic background in
Web Security & Privacy
; students with prior knowledge with
Web-development technology
(e.g., JavaScript), browser extensions, and browser architecture will be given priority;
some basic knowledge of
Machine Learning
is a plus;
proficiency in
spoken and written English is a must
(
C1 level
or higher); French knowledge is not necessary (note that English is the default language in the team);
we expect the student to be
curious, creative, and have a strong willingness to learn and improve
.