See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/224163004

Security vulnerabilities in modern web browser architecture

Conference Paper · June 2010

Source: IEEE Xplore

CITATIONS READS

11 3,499

3 authors, including:

Marin Silic Goran Delac

University of Zagreb University of Zagreb
24 PUBLICATIONS   172 CITATIONS    21 PUBLICATIONS   203 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Recommender System for Service-Oriented Architecture View project

Source code defect prediction View project

All content following this page was uploaded by Marin Silic on 23 August 2014.

The user has requested enhancement of the downloaded file.

 Security Vulnerabilities in Modern Web Browser Architecture

Marin Šilić
Faculty of Electrical Engineering and Computing, University of Zagreb
Unska 3, 10000 Zagreb, Croatia
Phone: +385 1 6129 549
E-mail: [email protected]

Abstract - The Web today has become the most used and Many different web applications can be executed
popular platform for application development. In the simultaneously within the web browser. Some applications
beginnings of the Web, applications provided users just can have significant reflection on user’s life, while some
ability to browse and read content. The expansion and can be malicious applications with the only intention to
adoption of the new web technologies has led to a significant compromise security. Each application in the browser has
increase in development and, more importantly, usage of the its own security settings that define application's privileges
web applications that allow users to create their own content and rights for the user’s local file system. For example,
and impact their life (e.g. e-banking, e-commerce, social web application should be allowed to access local file
networks). Web 2.0 applications introduced new possibilities system in order to upload a certain file only with user's
for both users and application developers, but also created explicit approval. On the other hand, browsers have their
new security concerns. Almost every Internet user uses a web local storage where user’s sensitive data like passwords,
browser to access any content on the Internet. Each web cookies, bookmarks, browsing history, temporary files,
application is designed and developed to be executed inside and cache are stored. Modern browsers need to assure that
the web browser. Web browser mediates between users and web application can not access that storage, and can only
applications. In such architecture, malicious applications get private data (e.g. cookies) related to that particular
could be loaded and executed inside the web browser, making application.
it a vulnerable point in preserving security. Modern web
In order to protect the user, some browsers enforce strict
applications demand for a new web browser architecture
security policy, which isolates applications inside the
design that will meet new security requirements arisen with
browser by their origin and does not allow subresources
the Web 2.0. In this paper, we study web browser's
from other origins. Such a restrictive policy would require
vulnerabilities, analyze popular web browsers architecture
architectural restructuring of existing Web. On the other
and present how they cope with potential security threats.
side, users expect browsers to be compatible with the
existing Web architecture and render their popular
applications. The desirable goal in browser design is to
I. INTRODUCTION achieve user’s protection and still to provide compatibility
with existing web applications.
In its basis, Web was designed for browsing static web
The majority of modern browsers still use the original
pages and reading content. With the recent technological
monolithic architecture design. Monolithic browser
improvements, the Web has become a platform for
architecture has many disadvantages that concern client
application development. The turning point was invention
code execution. Failure caused by one web application
and adoption of AJAX technology which turned from the
crashes down the entire browser instead of just the
old concept of static web pages to the new concept of
application that caused it. In terms of better user
creating interactive web applications. AJAX and similar
experience, user should be able to use other opened
web application development technologies, often referred
applications. From the aspect of security, if the browser as
to collectively as Web 2.0 technologies, led to the creation
a vulnerable monolithic structure gets compromised,
of variety of numerous worldwide-oriented web
attacker could execute his arbitrary code with user's
applications. Contemporary web applications like e-
privileges and rights and cause damage on local machine.
banking, e-commerce, social-networking sites, blogs, and
Modern applications require browser architecture that
video-sharing sites provide users not just the ability to
provides both browser security and compatibility with the
view information and access content, but also the ability to
existing Web architecture. That can be achieved with
contribute and create their own content on the Web,
modular browser architecture where, in contrast to
express their creativity and share knowledge and
monolithic one, each application is executed in its own
information with others.
sandbox with restricted privileges.
The nature of Web 2.0 applications requires users to
Section II explains modular browser architecture and
provide their identity and private data like user-names,
compares it with the monolithic one. In section III, we
passwords, credit card numbers, mailing addresses, social
review Google Chrome browser, as an implementation
security numbers, etc. Those applications are designed to
example of the modular browser architecture. We analyze
be executed inside the web browser, which is a mediator
how Chrome responds to major threats on browser
between users and applications. Web browser exploits
security. Section IV describes related browsers based on
have bigger impact than ever before, and thus web browser
modular architecture and compares them with Chrome.
designers have to pay more attention to security than ever
The paper finishes with conclusions in Section V.
before. Knowing the security holes in the web browser,
attackers can create malicious web applications in order to
compromise other users’ security.
 browser start up after the crash. But still, as a result of the
II. MULTI-PROCESS BROWSER crash user might lose valuable data (e.g. unsaved email
drafts, e-banking transactions, purchase orders) stored as a
As a result of recent break through in the Web JavaScript state in memory. After the browser restarts,
technology utilization contemporary web applications misbehaved application that caused crash might cause the
behave more like complex programs that demand crash again, in this case reload feature is pointless.
resources than simple documents for browsing. Most of Considering accountability, monolithic architecture
current web browser architectures are still monolithic, provides resources usage statistics for the entire web
usually designed for browsing and rendering static web browser. However, web program responsible for a poor
pages. Monolithic architectures do not provide enough performance of the entire browser can not be identified in
isolation between concurrently executed web programs a monolithic architecture. Another disadvantage of
and execution often ends in misbehavior as a lack of monolithic browser architecture is memory management.
security, fault-tolerance, memory management or Browser process in OS is a long life process compared to
performance. Early PC operating systems had same the life of web programs that are executed in the browser.
program isolation issues. MS-DOS and MacOS allocated Some web program running in the browser might require
single address space and programs interfered with each lot of memory allocation and contain memory leaks, which
other, unlike modern operating systems that isolate each can result in a large and fragmented memory space that is
program in its own separate process. Thus, modern allocated to the browser process. Once the web program
browser should isolate web programs and modularize their like that finishes, the memory still remains large and
execution assigning each web program to the specific fragmented. As far as performance is concerned,
operating system process within the browser. monolithic architectures can cause resource demanding
web programs to compete for CPU on with each other.
Also, monolithic architecture can block a browser UI
A. Monolithic browser architecture thread because web program's actions, like executing
synchronous XMLHttpRequest. Both of this causes user-
Figure 1 shows monolithic web browser architecture perceived delays on UI level and lower performance for
most common for current web browsers. In that the entire browser. Security of monolithic architectures
architecture, all web programs browser components are entirely rely on the browser components logic to
placed in a single operating system process. Document completely isolate different web programs and prevent any
Object Model (DOM) tree is a web page representation information flow between web objects in different web
that can be accessed and modified by the script code. programs. However, bugs omitted in browser design or
HTML Renderer component parses each page code and implementation, leave space for malicious web programs
generates DOM tree. JavaScript Engine is responsible for and attackers to install malware, steal files or access
running script code that manipulates DOM tree. private data and compromise user’s security.
Despite all its disadvantages, monolithic architecture is
preserved in the majority of web browser because it is
difficult and challenging to isolate web programs in the
browser and still keep browser compatibility. One
approach could be to isolate each web page in the browser,
but this would break many popular applications like sites
that use pop-up windows or embed content in a separate
frame from a different location. Another approach could
be to isolate web programs by their origins. However,
sometimes pages with different origins need to
communicate with each other and sometimes pages with
the same origins are not related at all.

B. Modular browser architecture

Figure 2 presents web programs isolation model,

implemented in Google Chrome web browser, based on
open source Chromium project [1]. The key point in
modular browser design is to isolate web programs, but
provide compatibility with the current Web. Presented
Figure 1. Modular browser architecture model introduces ideal abstractions: web program and web
program instance.
Web program is a set of connected web pages
Monolithic architecture has a lot of disadvantages that containing all their subresources that provide certain
concern user experience, fault-tolerance, accountability, functionality. For example, iGoogle page contains of
security, memory management and performance. From parent page, script libraries and images, and gadgets sites
user experience and fault-tolerance point of view, any web embedded in their frames. Since browsers allow users to
program or browser component that encounters crash, visit multiple instances of the same page, e.g. user can
takes down the complete web browser. Some browsers open two iGoogle pages in different tabs, web program
with monolithic architecture provide reload feature on instance abstraction is introduced.
 Web program instance is defined as a set of pages from
a web program that are connected in the browser and
allowed to access and manipulate each others content. Web
program abstraction is realized using site, while web
program instance abstraction is realized using site
instance.

Browsers allow related pages to communicate by

enforcing Same Origin Policy (SOP) [2]. SOP conducts
access control based on the page origin, which includes
protocol, full host name, and port of each page. Pages with Figure 2. Isolation model in Chromium
the same origins are grouped together and allowed to
manipulate each others content. Page subresources can be
included from some other origins, but their origin is One approach to accomplish isolation is to assign each
considered same as the origin of the enclosing page. If site instance to a one operating system process. In this
origins do not match, pages are mainly isolated. Origin case, there would be too many processes allocated for web
does not provide enough distinction among pages to define browser execution. Another approach is to assign each
site because web page can change its origin dynamically. browsing instance to a one operating system process.
The origin can be changed within a limited range, from Chromium manages to isolate web programs and
sub-domain to more general domain and only up to the modularize web browser execution. Each web program is
registry controlled domain name [3], which is the most running in its own operating system process.
general part of the host name before suffix (e.g. .fer.hr can
be changed to .hr). Site is defined as a set of web pages In comparison to monolithic architecture, modular
with origins within the specific origin range, limited with architecture is superior considering user experience, fault-
protocol and registry controlled domain name. tolerance, accountability, security, memory management
and performance. Considering user experience and fault-
Sometimes pages with a different origin are connected tolerance, each web program that crashes does not effect
and share communication channel. This is the case when a the execution of other running programs. In modular
page opens content in a new window, the opener page architecture each program performance can be easily
keeps reference on a new window and the opened page can monitored, thus modular architecture is superior in
access the opener using property window.opener. For accountability. Memory management in modular
example, Gmail chat window opens in a new window architecture is effectively conducted, each program has its
when the conversation starts. Second case is when a page own process and allocated memory, once the program
embeds content from different origin in a separate frame. finishes memory is released and can be assigned to some
For example, iGoogle page contains more gadgets pages in other program. The fact that each program has its own
separate frames. Top window can access its frames using process, assures better performance. Modular architecture
property windows.frames, and each gadget can access leaves scheduling issues to the OS and web programs can
parent window using property window.parent. run in parallel. Security aspects of modular architecture are
Connections between pages that share a communication presented in Section III.
channel are kept as long as the parent browser window is
alive. Even if the user navigates to another page or opens a
new page in a new tab or window references among those III. SECURITY OF CHROME
pages are kept. Chromium isolation model defines another
term, browsing instance as a set of connected windows or
The definition of web program isolation model is used
frames that keep a reference to each other.
as a base for modular architecture implementation. This
Site instance, the concrete realization of web program section presents modular browser architecture
instance abstraction, is defined as a set of connected pages implemented in Google Chrome browser. Furthermore,
that belong to the same site within the browsing instance. this section analyzes security aspects of Chrome’s
All pages from the same browsing instance can reference architecture.
each others windows, but only the pages from the same
site instance can access each others DOM contexts. On
figure 2 there are two browsing instances presented. First A. Chrome architecture
browsing instance B1 contains two site instances: Sa and
Sb. Second browsing instance B2 contains site instance Sa. Architecture of Chrome [4] browser is given in Figure 3.
Site instance Sa contains pages Pa and Pb, while site Chrome consists of three different modules: rendering
instance Sb contains page Pc. Site instance Sa from B1 and engine, browser kernel and plug-ins. Each of these
Sa from B2 belong to the same site, but do not reference modules is isolated in its own operating system process.
each other, although SOP would allow them to Rendering engine converts HTTP responses into rendered
communicate. On the other hand, site instances Sa and Sb bitmaps, browser kernel interacts with OS, and plug-ins
from B1 belong to different sites, they reference each module is responsible for each plug-in execution.
other, but still are not allowed to manipulate each other
DOM according to the SOP.
 token, unlike browser kernel that runs with Windows
user's security token [5]. Although Windows sandbox
restricts rendering engine to communicate with OS, there
are potential issues that can be exploited in order to
compromise the system. Sandbox does not perform
security token check if the sandboxed process is accessing
the FAT32 file system. Most of existing devices use NTFS
file system, but some USB devices use FAT32 formatting.
In this scenario, compromised rendering engine could read
and write the content on the USB drive. Also, Windows
sandbox does not perform security token or requires OS
handle when low-level privilege process attempts to open
TCP/IP socket. However, these issues rather concern
Figure 3. Chrome architecture Windows sandbox then Chromium architecture. System
can be compromised if the browser kernel gets
compromised. Browser kernel can be tricked from a
compromised rendering engine. While executing APIs, as
Rendering engine runs in a sandbox with restricted a lack of parameters validation, browser kernel can
privileges and no access to OS. Each isolated web program perform unauthorized network or system task. Another
in the browser is assigned to its own rendering engine. way how system could get compromised is to exploit
Rendering engine is responsible for parsing web content, vulnerabilities in vendors’ plug-ins that run outside the
creating DOM tree representation in memory, sandbox by default.
manipulating the DOM tree while executing script
instructions. Also, rendering engine enforces SOP policy Data theft threat refers to the ability to steal local
and manipulates directly with untrusted web content. network or system data. This often happens in case
Historically most of the web browser security compromised rendering engine requires uploading or
vulnerabilities were detected in the parsing and decoding downloading a file. In Chrome architecture rendering
tasks. Thus, rendering engine does most of the parsing like engine runs in a sandbox and has no direct access to the
HTML, CSS, XML, JavaScript, regular expressions local file system. When uploading a file, rendering engine
parsing and image decoding. To interact with the user and uses browser kernel API for file upload. Browser kernel
OS, rendering engine uses simple and restricted browser shows the upload file picker window and remembers
kernel APIs. which file is selected. This action is considered as a
explicit user authorization to the associated rendering
Browser kernel runs with full user privileges on behalf engine to upload that particular file and that authorization
of the user. It manages each instance of the rendering lasts for the lifetime of the associated rendering engine. In
engine and implements browser kernel APIs. Browser the next step, browser kernel uploads the file to the site
kernel is responsible for storage management, which which instance is running in the associated rendering
includes cookies, bookmarks, passwords, because such engine. Also, when downloading files, rendering engine
activity requires file system access. Browser kernel is uses browser kernel API to download file. Since the
executing network operations, e.g. downloads the image, download is initiated by the user, browser kernel is
but sends it to rendering engine to decode it. Also, browser authorized to download the resource from the download
kernel is interacting with OS, handles user inputs and URL. Some malicious site may include subresources with
forwards it to a rendering engine that has a focus. Browser URLs that use file scheme. Chrome architecture prevents
kernel, keeps the information about granted privileges to rendering engine to issue network tasks, like requesting a
each rendering engine such as list of files that certain resource from a specified URL. Rendering engine rather
rendering engine may upload. uses browser kernel API to include subresources, then
Plug-ins runs in its own process outside the rendering browser kernel analyzes the resource URL and downloads
engine and browser kernel. Web compatibility requires the resource. Most of the rendering engines are not
plug-ins to run outside the sandbox, plug-ins may require allowed to include subresources from URLs that uses file
access to microphone, web cam or local file system. Thus, scheme. However, local files can be viewed in Chrome
plug-ins can not be placed inside rendering engine since browser, but in a dedicated rendering engine.
rendering engine runs in a sandbox. Plug-ins could be Cross domain compromise Code originating from one
placed within the browser kernel, but in this case, crash in fully qualified domain name (FQDN) [6] can execute code
plug-ins would take down the entire browser. However, in the context of, or read data from, another FQDN domain
bug omitted in plug-in design or implementation could be without permission. One such attack is XML eXternal
exploited to compromise security and arbitrary code with Entity (XXE) attack, in which the attacker's XML
full user's privileges. document, hosted at http://attacker.com/, includes an
external entity from a foreign origin [7]. For example, the
B. Security aspects malicious XML document might contain an entity from the
https://bank.com or file:///etc/passwd. If vulnerable to
System compromise threat refers to malicious arbitrary XXE attacks, the browser will retrieve the content from the
code execution with full privileges on behalf of the user. foreign origin and incorporate it into the attacker's
The majority of browser's vulnerabilities that concern this document, making him able to read the content.
threat are detected in rendering engine that can be Chrome, like many other browsers, uses libXML to parse
compromised. Compromised rendering engine runs within XML documents. However, the architecture of Chrome is
a Windows sandbox, with Windows restricted security designed in such a way that it delegates parsing tasks to a
sand-boxed rendering engine. The rendering engine does IV. RELATED ARCHITECTURES OVERVIEW
not prevent the content from retrieving URLs from foreign
origins, but passes the requests to the browser kernel. If OP Browser [12] introduces modular architecture that
the external entity URL was a web URL, browser kernel consists of following browser components: UI, web page,
serviced the requests. However, if the external entity URL storage, network and browser kernel. Each component
was from the user's file system (i.e. from the file scheme), runs in its own operating system process. Browser kernel
then the browser blocked the request, preventing the runs with full privileges and behaves like the operating
attacker from reading confidential information such as system micro-kernel. It coordinates the communication
passwords. Chrome's modular architecture with sand- among browser components using message passing
boxed rendering engines does not completely defend mechanism. Compared to Google Chrome, proposed
against the XXE vulnerability because the attacker is able architecture provides strong isolation among web sites and
to retrieve URLs from foreign web sites. To block such higher level of protection, but makes impossible to
requests, the browser kernel would need to sacrifice implement some popular web features like inter-frame
compatibility with the Web architecture (e.g. ban cross-site communication, file uploads and downloads. These
images). characteristics make OP browser incompatible with many
The threats that involve session hijacking compromise popular web sites. OP browser enforces restrictive plug-ins
the session token by stealing or predicting a valid session security policy. Architecture does not allow plug-ins to run
token to gain unauthorized access to the honest web server. with full privileges in their own process on the whole
Cross-site scripting (XSS) and cross-domain request browser level. Instead, plug-ins run within the web page
forgery (CSRF) have become the two most scaled attacks component with restrictive privileges. Plug-ins are allowed
regarding session hijacking. According to The Open Web to access the resources that correspond to the origin of the
Application Security Project (OWASP), those two kind of site whence the plug-in object is embedded. Sandboxing
attacks have been marked as No2 and No5 top security plug-ins using restrictive policy provides higher
risks for web applications for the year 2010 [8]. In short, protection, but makes browser less compatible with the
XSS exploits the client's trust of the content received from current Web.
the server (by just sending text-based attack scripts that Tahoma [13] architecture introduces a new concept for
exploit the interpreter in the browser). This allows web application execution. Each web site is running on its
attackers to execute scripts in the victim’s browser which own virtual machine within the protected framework
can hijack user sessions, deface web sites, or redirect the named browser operating system (BOS). BOS manages
user to malicious sites. A CSRF attack tricks (via image or each virtual machine's network and UI tasks. Each virtual
script tags) a logged-on victim’s browser to send a forged machine manages its own storage, cookies, bookmarks,
HTTP request, including the victim’s session cookie and history and has no access to the user's local file system.
any other authentication information, to a vulnerable web There is a strict isolation among different running virtual
application. This allows the attacker to perform any action machines. Tahoma architecture introduces new possibility
on a vulnerable web server the victim is authorized to use. for web application execution. Since the web application is
Chrome's architecture does not protect an honest web site running on virtual machine, web application developer can
if the site contains XSS or CSRF vulnerabilities. Chrome deploy application in machine code language. Each web
expects these sites to repair their vulnerabilities. The only site owner should create manifest file for his web site. That
helpful thing Chrome has is support for HttpOnly cookies, manifest file contains information about the site like the
which can be used as a partial mitigation for XSS [9]. list of URLs site is communicating with or weather the site
User interface compromise threat refers to the ability to uses machine code or standard HTML renderer. When first
trick the user into making incorrect trust decision, or visiting the site, user receives site manifest and needs to
directly provide confidential data using script UI approve the site before execution begins. Tahoma
manipulation. Popular attack that manipulates UI is architecture is revolutionary and provides high level of
clickjacking [10]. In clickjacking, attacker loads protection. However, this architecture is completely
subresource from some other origin and places it to be incompatible with the current Web and requires current
transparent content in front of the visible content. User Web restructuring.
thinks he clicks on the objects he sees, but actually he Gazelle browser [14] architecture contains browser
clicks on the transparent content. Also, user interface kernel and rendering engine process, similar like Google
compromise refers to implementing annoying scripting Chrome. Google Chrome places resources within the same
actions like hogging the CPU or memory, moving dialogs renderer according to the registry controlled domain name
faster then user can respond, opening dialogs in endless policy, while Gazelle places resources within the same
loop. From today's perspective, no modern browser renderer according to the SOP. Gazelle architecture
provides enough security restrictions to defend itself from provides stronger isolation that concerns inter-frame
scripting disruptions. Introduction of any limitations that scripting. In case the web page embeds content in a
are related to window manipulation or disabling pop-ups, separate frame, Gazelle places parent and child frame in to
provides less functionality and options for site developers different renderer processes and allows them to
and lowers compatibility with Web. However, Google communicate using limited browser kernel API. On the
Chrome uses limitations on windows manipulation [11] other side, Google Chrome places the parent and child
with scripting languages such as taking full screen, frame in the same renderer process, but the communication
specifying screen dimensions and position, hiding URL among them is restricted according to the SOP. Cross
bar and status bar. scripts and style sheets are placed within the same renderer
process both in Chrome and Gazelle. However, because of
the cross-scripting and inter-frame communication
limitations, Gazelle is not quite compatible with the
current Web. For, example, Gazelle does not allow the October 2002.
frame to change its document.domain property, which is http://www.securiteam.com/securitynews/6D0100A5P
essential for inter-frame communication before U.html
postMessage event introduction. Also, Gazelle introduces [8] The Open Web Application Security Project: OWASP Top10
opaque display policy, which disallows cross-site content
- 2010 rc1, “The Ten Most Critical Web Application
to be transparent and overlap the host site. This policy
Security Risks”,
enhances the overall browser security and reduces UI
manipulation, but still it is not quite compatible with the http://www.owasp.org/images/0/0f/OWASP_T10_-
current Web. Gazelle browser tends to protect different _2010_rc1.pdf
web sites from each other, while Chrome focuses on host [9] Microsoft: “Mitigating cross-site scripting with HTTP-only
machine's and user's protection. cookies”,
http://msdn.microsoft.com/en-us/library/ms533046.aspx
[10] M. Balduzzi, M. Egele, E. Kirda, D. Balzarotti, C. Kruegel:
V. CONCLUSION “A Solution for the Automated Detection of Clickjacking
Attacks“, ASIACCS’10, Beijing, China, 2010.
In this paper we described the concept of web program [11] M. Zalewski: “Browser Security Handbook”, 2009.
isolation in the browser as a response to new security http://code.google.com/p/browsersec/wiki/Main
challenges and performance demands introduced with the [12] C. Grier, S. Tang, S. T. King: “Secure web browsing with
Web evolution in recent years. We compared the new
the OP web browser”, 2008 IEEE Symposium on
modular architecture to the monolithic architecture most
Security and Privacy
used in current web browsers and showed that modular
architecture is superior. [13] R. S. Cox, J. G. Hansen, S. D. Gribble, H. M. Levy: “A
Safety-Oriented Platform for Web Applications”, 2006
We reviewed modular architecture implemented in
Google Chrome web browser. We analyzed Chrome’s IEEE Symposium on Security and Privacy
behavior concerning the most popular security web [14] H. J. Wang, C. Griery, A. Moshchukz, S. T. Kingy, P.
browser threats. We showed that modular architecture of Choudhury, H. Venter: “The Multi-Principal OS
Chrome mitigates most serious treats that are related to Construction of the Gazelle Web Browser“, MSR
system compromise and data theft. Technical Report MSR-TR-2009-16
However, Chrome’s architecture does not provide the
full protection. Threats that are related to cross-site
attacking, session hijacking and user interface compromise
are not mitigated. We reviewed similar architectures
implemented in OP, Tahoma and Gazelle web browser.
These architectures sacrifice compatibility with the current
Web in order to provide higher level of security that
Chrome.

REFERENCES

[1] C. Reis and S.D. Gribble, “Isolating web programs in modern

browser architectures”, Proceedings of the 4th ACM
European conference on Computer systems, April 01-03,
2009, Nuremberg, Germany
[2] Jesse Ruderman, “The Same Origin Policy”,
http://www.mozilla.org/projects/security/components/s
ame-origin.html, 2001.
[3] Mozilla, “Public Suffix List”,
http://publicsuffix.org/, 2007.
[4] A. Barth, C. Jackson, C. Reis, and Google Chrome Team,
“The Security Architecture of the Chromium Browser”,
Technical report, Stanford University, 2008.
http://crypto.stanford.edu/websec/chromium/chromium
-security-architecture.pdf.
[5] Microsoft: “Restricted Tokens”, February 2010.
http://msdn.microsoft.com/en-
us/library/aa379316(VS.85).aspx
[6] Indiana University Knowledge Base: “Fully qualified domain
name“, October 2009.
http://kb.iu.edu/data/aiuv.html
[7] G. Steuck: „XXE (Xml eXternal Entity) attack“,

View publication stats