PhD Position F/M Detecting Dangerous Browser Extensions to Protect the Security and Privacy of Web Users

Inria Sophia Antipolis; Valbonne; In loco; EUR 24.000 - 30.000; Tempo pieno

Descrizione del lavoro

Inria Sophia Antipolis is offering a PhD position within the ANR JCJC project EXPELLIARMUS on disarming dangerous browser extensions to protect user security and privacy. You will join the research team led by Dr. Nataliia Bielova at the Inria Centre on the French Riviera, supervised by Dr.-Ing.

Aurore Fass. The PhD typically lasts three years in France. The role focuses on automated detection and analysis of malicious browser extensions, building datasets, and contributing to interdisciplinary

Competenze

• Strong programming skills in Python and JavaScript.
• Background in Web Security and Web Privacy research.
• Experience with browser extensions and browser architecture helpful.

Mansioni

• Contribute to the EXPELLIARMUS project under ANR JCJC funding.
• Carry out rigorous research in browser extension security and privacy.
• Assist in producing datasets, tooling, and publications with the team.

Conoscenze

Python

JavaScript

Web Security

Web Privacy

Machine Learning

Browser Extensions

English Proficiency

Formazione

Master's degree in Computer Science

Cybersecurity background

Descrizione del lavoro

Context

The PhD position is funded by the French National Research Agency (ANR). It is part of Aurore Fass' ANR JCJC project "EXPELLIARMUS: Disarming Dangerous Browser Extensions to Protect the Security and Privacy of Web Users". EXPELLIARMUS, aims to develop methods to "disarm" dangerous extensions to better protect the security and privacy of Web users. More specifically, it will detect, understand, and mitigate dangerous browser extensions through an interdisciplinary approach combining computer science, human factors, and legal analysis. EXPELLIARMUS will deliver a systematic taxonomy of dangerous extension behaviors, open-source datasets and detection tools, as well as actionable recommendations for users, browser vendors, developers, and regulators. The PhD student will be part of the research team led by Dr. Nataliia Bielova (https://www-sop.inria.fr/members/Nataliia.Bielova/index.html) at the Inria Centre at Université Côte d’Azur at the French Riviera. The PhD student will be supervised by Dr.-Ing. Aurore Fass (https://aurore54f.github.io/). Note that a PhD in France typically lasts 3 years.

Assignment

Context on Browser Extension Security Given the central role of the Web in our daily lives and its overall impact on society and economy, it is crucial that Web pages and browser extensions assure the security and privacy and of their large user base. Browser extensions have become an integral part of the modern Web ecosystem. The most popular desktop browser Chrome lists 280k browser extensions [1] (totaling almost 3 billion active users) in its official gallery, the Chrome Web Store [2]. Browser extensions enable users to enhance and customize their browsing experience: typically, extensions offer additional functionality to Web users, such as ad blocking (e.g., AdBlock), grammar checks (e.g., Grammarly), or password management (e.g., LastPass). To operate, browser extensions need elevated privileges compared to Web pages. Browser extensions can access sensitive user data, such as cookies or browsing history, and they can interact with arbitrary websites and other extensions [3, 4, 5]. While a compromised or malicious Web page is in itself troublesome, a malicious or vulnerable browser extension is much more powerful, as an attacker can leverage an extension's elevated privileges to cause more harm [3]. In particular, browser extensions can exfiltrate sensitive user data [6], track users online [7], or propagate unwanted software [8]. Detecting such threats at scale remains a challenge, as the extension ecosystem is particularly large, diverse, and continuously evolving.

Limitations of existing work

Abundant prior work attempted to detect some classes of dangerous extensions [9], e.g., malicious [10], vulnerable [3], or fingerprintable extensions [11]. However, related works have major limitations. Existing works analyze only hundreds of extensions [12], are outdated (e.g., 2012–2015 [8, 13, 14, 15]), have limited scalability and necessitate significant manual effort [16, 4], lack a clear characterization of what a dangerous behavior is [14]; and finally, only a small minority thereof is open source, as we have highlighted in [1 0]. Besides, existing machine learning-based detectors are opaque, they lack interpretability and explainability. It is therefore critical to design automated, large-scale, and reliable security and privacy analyses of browser extensions that have the potential to be deployed in the real world.

References

[1] chrome-stats. Chrome extension statistics. https://chrome-stats.com/chrome/stats

[2] Google. Chrome Web Store. https://chromewebstore.google.com

[3] Aurore Fass, Dolière Francis Somé, Michael Backes, and Ben Stock. DoubleX: Statically Detecting Vulnerable Data Flows in Browser Extensions at Scale. In ACM CCS, 2021. Code repository: https://github.com/Aurore54F/DoubleX

[4] Dolière Francis Somé. Empoweb: Empowering web applications with browser extensions. In IEEE S&P, 2019.

[5] Jianjia Yu, Song Li, Junmin Zhu, and Yinzhi Cao. Coco: Efficient browser extension vulnerability detection via coverage-guided, con- current abstract interpretation. In ACM CCS, 2023.

[6] Quan Chen and Alexandros Kapravelos. Mystique: Uncovering information leakage from browser extensions. In ACM CCS, 2018.

[7] Michael Weissbacher, Enrico Mariconti, Guillermo Suarez-Tangil, Gianluca Stringhini, William Robertson, and Engin Kirda. Ex-ray: Detection of history-leaking browser extensions. In ACSAC, 2017.

[8] Xinyu Xing, Wei Meng, Byoungyoung Lee, Udi Weinsberg, Anmol Sheth, Roberto Perdisci, and Wenke Lee. Understanding malvertising through ad-injecting browser extensions. In TheWebConf, 2015.

[9] Sheryl Hsu, Manda Tran, and Aurore Fass. What is in the Chrome Web Store? Investigating Security-Noteworthy Browser Extensions. In ACM AsiaCCS, 2024.

[10] Ben Rosenzweig, Valentino Dalla Valle, Giovanni Apruzzese, and Aurore Fass. It's not easy: Applying supervised machine learning to detect malicious extensions in the chrome web store. In ACM Transactions on the Web (TWEB), 2026. Code repository: https://github.com/its-not-easy/tweb25/tree/main

[11] Shubham Agarwal, Aurore Fass, and Ben Stock. Peeking through the window: Fingerprinting browser extensions through page-visible execution traces and interactions. In ACM CCS, 2024. Code repository: https://github.com/raider-ext/raider

[12] Nicholas Carlini, Adrienne Porter Felt, and David Wagner. An evaluation of the google chrome extension security architecture. In USENIX Security, 2012.

[13] Nav Jagpal, Eric Dingle, Jean-Philippe Gravel, Panayiotis Mavrommatis, Niels Provos, Moheeb Abu Rajab, and Kurt Thomas. Trends and lessons from three years fighting malicious extensions. In USENIX Security, 2015.

[14] Alexandros Kapravelos, Chris Grier, Neha Chachra, Christopher Kruegel, Giovanni Vigna, and Vern Paxson. Hulk: Eliciting malicious behavior in browser extensions. In USENIX Security, 2014.

[15] Kurt Thomas, Elie Bursztein, Chris Grier, Grant Ho, Nav Jagpal, Alexandros Kapravelos, Damon Mccoy, Antonio Nappa, Vern Paxson, Paul Pearce, Niels Provos, and Moheeb Abu Rajab. Ad injection at scale: Assessing deceptive advertisement modifications. In IEEE S&P, 2015.

[16] Nikolaos Pantelaios, Nick Nikiforakis, and Alexandros Kapravelos. You’ve changed: Detecting malicious browser extensions through their update deltas. In ACM CCS, 2020.

Main activities

Objectives of the PhD The broad objective of this PhD is to develop new automated tools to detect dangerous browser extensions, with a specific focus on malicious extensions. While the majority of prior work focuses on Chrome, we also want to study dangerous extensions on other browsers, such as Firefox and Edge, since we showed that the same malicious extensions can be published on multiple galleries [1].

• Objective 1: Generate a large-scale dataset of browser extensions. Establish a systematic and comprehensive taxonomy of dangerous browser extension behaviors.
• Objective 2: Design novel, automated, and explainable methods to detect dangerous browser extensions, combining JavaScript static and lightweight dynamic analyses, predictive machine learning, and Large-Language Models. Provide interpretable and continuously adaptable detection models.
• Objective 3 (in collaboration with a postdoctoral researcher, to be recruited): Assess how different stakeholders (i.e., platform maintainers, developers, and users) understand and manage the underlying security and privacy risks of browser extensions.

Keywords

Web Security & Privacy, Browser Extensions, Dangerous Behavior Detection, Code Analysis, Applied Machine Learning, (Human Factors).

References

[1] Abdullah Hassan Chaudhry, Valentino Dalla Valle, and Aurore Fass. Two Heads are Better Than One: Analysing Browser Extensions Across Stores. In MADWeb (workshop co-located with NDSS), 2026. Code repository: https://github.com/abdchau/two-heads-are-better

[2] Ben Rosenzweig, Valentino Dalla Valle, and Aurore Fass. It's not easy: Applying supervised machine learning to detect malicious extensions in the chrome web store. In ACM Transactions on the Web (TWEB), 2026. Code repository: https://github.com/its-not-easy/tweb25/tree/main

[3] Ben Rosenzweig, Valentino Dalla Valle, and Aurore Fass. What's in the Chrome Web Store? Investigating security and reputation of extensions. In ACM Transactions on the Web (TWEB), 2026. Code repository: https://github.com/its-not-easy/else???

[4] François Bizert, Dominique S

Skills

A successful candidate for a PhD: should have a strong background in Computer Science (Master degree or equivalent); with a major ideally in Cybersecurity; their research interests should be in Web Security, Web Privacy, or Web Measurements.

We are looking for a motivated student with: solid programming skills in python; (at least) a basic background in Web Security & Privacy; students with prior knowledge with Web-development technology (e.g., JavaScript), browser extensions, and browser architecture will be given priority; some basic knowledge of Machine Learning is a plus; proficiency in spoken and written English is a must (C1 level or higher); French knowledge is not necessary (note that English is the default language in the team); we expect the student to be curious, creative, and have a strong willingness to learn and improve.