Jan Niklas Drescher

Publications

Are your Sites Truly Isolated? Automatically Detecting Logic Bugs in Site Isolation Implementations
Jan Drescher, David Klein, and Martin Johns
Network and Distributed System Security (NDSS) Symposium, 2026, [BIB], [GitHub], [Zenodo], [Talk], [Slides]

In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web
Jan Drescher, Sepehr Mirzaei, Soheil Khodayari, David Klein, Thomas Barber, Martin Johns, and Giancarlo Pellegrino
ACM Conference on Computer and Communications Security (CCS), 2025, [BIB], [Github], [Zenodo]

HyTrack: Resurrectable and Persistent Tracking Across Android Apps and the Web
Malte Wessels, Simon Koch, Jan Drescher, Louis Bettels, David Klein, and Martin Johns
34th USENIX Security Symposium (USENIX Security'25), 2025 [BIB]

“Data Protection Can Sometimes Be a Nuisance” A Notification Study on Data Sharing Practices in City Apps
Jan Niklas Drescher, Jakob Moser, Nicolas Strangmann, Jonas Spinner, Dominik Herrmann, Melanie Volkamer
Mensch und Computer, Usable Security und Privacy Workshop, 2024 [BIB]

Talks

How To Fuzz for Logic Bugs? Building Effective Oracles - A Case Study on Site Isolation Bypass Bugs
TBA, German OWASP Day 2026, Karlsruhe

Web Vulnerability Validation
13.07.2026, Dagstuhl Seminar Web Application Security 2026, Schloss Dagstuhl

Detecting Site Isolation Bypass Vulnerabilities
31.03.2025, Google-Hosted Event on AI in Security and Vulnerability Scanning & Management, München

Vulnerabilities

• CVE-2024-9392: Firefox is affected by a Site Isolation bypass vulnerability. A compromised renderer process could load documents from arbitrary sites.