Peripheral Instinct: How External Devices Breach Browser Sandboxes
Browser APIs such as WebHID, WebUSB, Web Serial, and Web MIDI enable web applications to interact directly with external devices. The support of such APIs in Chromium-based browsers, such as Chrome and Edge, radically changes the threat model for peripherals and increases the attack surface. In the past, devices could assume a trusted host, i.e., the operating system. Now, the host is a potentially malicious website and cannot be trusted.
Authors
- Leon Trampert (ORCID: https://orcid.org/0009-0001-6891-965X)
- Christian Rossow (ORCID: https://orcid.org/0000-0003-2470-8444)
- Michael Schwarz (ORCID: https://orcid.org/0000-0001-6744-3410)
- Lorenz Hetterich (ORCID: https://orcid.org/0009-0007-1201-0299)
- L. O. Gerlach (ORCID: https://orcid.org/0009-0002-6684-2035)
- Mona Schappert
Institutions
- Helmholtz Center for Information Security (DE)
- Saarland University (DE)
Publication Details
- Published
- 2025-04-22
- DOI
- https://doi.org/10.1145/3696410.3714637
- Primary Topic
- Advanced Malware Detection Techniques
- Type
- article
- Field-Weighted Citation Impact
- 0.00