{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T08:23:03Z","timestamp":1792743783944,"version":"4.5.0"},"reference-count":78,"publisher":"IEEE","license":[{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2022,5,1]],"date-time":"2022-05-01T00:00:00Z","timestamp":1651363200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"funder":[{"DOI":"10.13039\/100000181","name":"Air Force Office of Scientific Research","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000181","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100003977","name":"Israel Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100003977","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100011993","name":"Robert Bosch","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100011993","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,5]]},"DOI":"10.1109\/sp46214.2022.9833711","type":"proceedings-article","created":{"date-parts":[[2022,7,27]],"date-time":"2022-07-27T19:28:05Z","timestamp":1658950085000},"page":"699-715","source":"Crossref","is-referenced-by-count":20,"title":["Spook.js: Attacking Chrome Strict Site Isolation via Speculative Execution"],"prefix":"10.1109","author":[{"given":"Ayush","family":"Agarwal","sequence":"first","affiliation":[{"name":"University of Michigan"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sioli","family":"O\u2019Connell","sequence":"additional","affiliation":[{"name":"University of Adelaide"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jason","family":"Kim","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shaked","family":"Yehezkel","sequence":"additional","affiliation":[{"name":"Tel Aviv University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Daniel","family":"Genkin","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Eyal","family":"Ronen","sequence":"additional","affiliation":[{"name":"Tel Aviv University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuval","family":"Yarom","sequence":"additional","affiliation":[{"name":"University of Adelaide"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref13","year":"2020","journal-title":"Public Suffix List"},{"key":"ref57","author":"reis","year":"2021","journal-title":"Issue 1209417 Add feature for all extensions to require locked processes"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978374"},{"key":"ref56","first-page":"1661","article-title":"Site isolation: process separation for web sites within the browser","author":"reis","year":"2019","journal-title":"Usenix Security"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00022"},{"key":"ref59","first-page":"435","article-title":"The 9 lives of Bleichenbacher’s CAT: new cache attacks on TLS implementations","author":"ronen","year":"2019","journal-title":"IEEE SP"},{"key":"ref14","year":"2021","journal-title":"Strict extension isolation coming to google chrome"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653687"},{"key":"ref53","article-title":"Rage against the machine clear: A systematic analysis of machine clears and their implications for transient execution attacks","author":"ragab","year":"2021","journal-title":"Usenix Security"},{"key":"ref52","year":"2016","journal-title":"window performance now does not support sub-millisecond precision on windows"},{"key":"ref11","article-title":"SMASH: Synchronized many-sided Rowhammer attacks from JavaScript","author":"ridder","year":"2021","journal-title":"Usenix Security"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/1551644.1556050"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00046"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00020"},{"key":"ref17","first-page":"231","article-title":"Cache vs. key-dependency: Side channeling an implementation of Pilsung","volume":"2020","author":"genkin","year":"2020","journal-title":"IACR Trans Cryptogr Hardw Embed Syst"},{"key":"ref16","first-page":"83","article-title":"Driveby key-extraction cache attacks from portable code","author":"genkin","year":"2018","journal-title":"ACNS"},{"key":"ref19","year":"2021","journal-title":"Partition allocator"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417289"},{"key":"ref51","author":"pizlo","year":"2018","journal-title":"What Spectre and Meltdown Mean For WebKit"},{"key":"ref50","first-page":"565","article-title":"DRAMA: Exploiting DRAM addressing for cross-CPU attacks","author":"pessl","year":"2016","journal-title":"Usenix Security"},{"key":"ref46","author":"nguyen","year":"2017","journal-title":"The best Firefox ever"},{"key":"ref45","year":"2021","journal-title":"Firefox browser nightly"},{"key":"ref48","first-page":"1","article-title":"Cache attacks and countermeasures: The case of AES","author":"osvik","year":"2006","journal-title":"CT-RSA"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813708"},{"key":"ref42","author":"meurer","year":"2017","journal-title":"An introduction to speculative optimization in v8"},{"key":"ref41","article-title":"Spectre is here to stay: An analysis of side-channels and speculative execution","author":"mcilroy","year":"2019","journal-title":"CoRR abs\/1902 05178"},{"key":"ref44","year":"2021","journal-title":"Project Fission"},{"key":"ref43","first-page":"69","article-title":"CacheZoom: How SGX amplifies the power of cache attacks","author":"moghimi","year":"2017","journal-title":"CHES"},{"key":"ref49","article-title":"Cache missing for fun and profit","author":"percival","year":"2005","journal-title":"Proceedings of BSDCan"},{"key":"ref8","first-page":"249","article-title":"A systematic evaluation of transient execution attacks and defenses","author":"canella","year":"2019","journal-title":"Usenix Security"},{"key":"ref7","year":"2021","journal-title":"Browse 3x faster than Chrome"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363219"},{"key":"ref4","author":"archibald","year":"2021","journal-title":"Sharedarraybuffer updates in android chrome 88 and desktop chrome 91"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.44"},{"key":"ref6","article-title":"Software grand exposure: SGX cache attacks are practical","author":"brasser","year":"2017","journal-title":"WOOT"},{"key":"ref5","article-title":"Origin cookies: Session integrity for web applications","author":"bortz","year":"2011","journal-title":"In Web 2 0 Security & Privacy"},{"key":"ref40","article-title":"Bypassing memory safety mechanisms through speculative control flow hijacks","author":"mambretti","year":"2020","journal-title":"arXiv preprint arXiv 2003"},{"key":"ref35","year":"2021","journal-title":"How it works"},{"key":"ref34","article-title":"Spectre returns! speculation attacks using the return stack buffer","author":"koruyeh","year":"2018","journal-title":"WOOT"},{"key":"ref78","author":"zeigler","year":"2008","journal-title":"Sharedarraybuffer updates in android chrome 88 and desktop chrome 91"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2015.43"},{"key":"ref36","first-page":"973","article-title":"Meltdown: Reading kernel memory from user space","author":"lipp","year":"2018","journal-title":"Usenix Security"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00002"},{"key":"ref75","article-title":"Controlled-channel attacks: Deterministic side channels for untrusted operating systems","author":"xu","year":"2016","journal-title":"IEEE SP"},{"key":"ref30","article-title":"An analysis of speculative type confusion vulnerabilities in the wild","author":"kirzner","year":"2021","journal-title":"Usenix Security"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134038"},{"key":"ref33","first-page":"69","article-title":"On the effectiveness of mitigations against floating-point timing channels","author":"kohlbrenner","year":"2017","journal-title":"Usenix Security"},{"key":"ref77","first-page":"719","article-title":"FLUSH + RELOAD: A high resolution, low noise, L3 cache side-channel attack","author":"yarom","year":"2014","journal-title":"Usenix Security"},{"key":"ref32","first-page":"463","article-title":"Trusted browsers for uncertain times","author":"kohlbrenner","year":"2016","journal-title":"Usenix Security"},{"key":"ref76","first-page":"2003","article-title":"Cache telepathy: Leveraging shared resource attacks to learn DNN architectures","author":"yan","year":"2020","journal-title":"Usenix Security"},{"key":"ref2","doi-asserted-by":"crossref","first-page":"11","DOI":"10.1145\/1314466.1314469","article-title":"Yet another microarchitectural attack: Exploiting Icache","author":"ac?i\u00e7mez","year":"2007","journal-title":"CSAW"},{"key":"ref1","year":"2011","journal-title":"WebKit"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243761"},{"key":"ref38","article-title":"Bypassing KPTI using the speculative behavior of the SWAPGS instruction","author":"lu?a?","year":"2019","journal-title":"BlackHat Europe"},{"key":"ref71","first-page":"88","article-title":"RIDL: rogue in-flight data load","author":"schaik","year":"2019","journal-title":"IEEE SP"},{"key":"ref70","first-page":"54","article-title":"LVI: hijacking transient execution through microarchitectural load value injection","author":"bulck","year":"2020","journal-title":"IEEE SP"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3385412.3386008"},{"key":"ref72","article-title":"CacheOut: Leaking data on Intel CPUs via cache evictions","author":"schaik","year":"2021","journal-title":"Usenix Security"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329804"},{"key":"ref68","year":"2017","journal-title":"Launching ignition and turbofan"},{"key":"ref23","first-page":"300","article-title":"Rowhammer.js: A remote software-induced fault attack in JavaScript","author":"gruss","year":"2016","journal-title":"DIMVA"},{"key":"ref67","author":"tankovska","year":"2019","journal-title":"Combined desktop and mobile visits to Tumblr com"},{"key":"ref26","author":"horn","year":"2018","journal-title":"speculative execution variant 4 speculative store bypass"},{"key":"ref25","author":"hadad","year":"2018","journal-title":"Overcoming (some) Spectre browser mitigations"},{"key":"ref69","first-page":"991","article-title":"Foreshadow: Extracting the keys to the intel SGX kingdom with transient out-of-order execution","author":"bulck","year":"2018","journal-title":"Usenix Security"},{"key":"ref20","year":"2021","journal-title":"SPECTRE"},{"key":"ref64","first-page":"639","article-title":"Robust website fingerprinting through the cache occupancy channel","author":"shusterman","year":"2019","journal-title":"Usenix Security"},{"key":"ref63","author":"sheludko","year":"2020","journal-title":"Pointer compression in V8"},{"key":"ref22","first-page":"897","article-title":"Cache template attacks: Automating attacks on inclusive last-level caches","author":"gruss","year":"2015","journal-title":"Usenix Security"},{"key":"ref66","article-title":"Can i take your subdomain? exploring same-site attacks in the modern web","author":"squarcina","year":"2021","journal-title":"Usenix Security"},{"key":"ref21","first-page":"955","article-title":"Translation leak-aside buffer: Defeating cache side-channel protections with TLB attacks","author":"gras","year":"2018","journal-title":"Usenix Security"},{"key":"ref65","article-title":"Prime+Probe 1, JavaScript 0: Overcoming browser-based side-channel defenses","author":"shusterman","year":"2021","journal-title":"Usenix Security"},{"key":"ref28","year":"2021","journal-title":"Global desktop browser market share for 2021"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.23"},{"key":"ref29","article-title":"Speculative buffer overflows: Attacks and defenses","author":"kiriansky","year":"2018","journal-title":"CoRR abs\/1807 03757"},{"key":"ref60","doi-asserted-by":"crossref","first-page":"247","DOI":"10.1007\/978-3-319-70972-7_13","article-title":"Fantastic timers and where to find them: High-resolution microarchitectural attacks in JavaScript","author":"schwarz","year":"2017","journal-title":"Financial Cryptography and Data Security"},{"key":"ref62","article-title":"Database reconstruction from noisy volumes: A cache side-channel attack on SQLite","author":"shahverdi","year":"2021","journal-title":"Usenix Security"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354252"}],"event":{"name":"2022 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2022,5,22]]},"end":{"date-parts":[[2022,5,26]]}},"container-title":["2022 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/9833550\/9833558\/09833711.pdf?arnumber=9833711","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,11,8]],"date-time":"2023-11-08T23:06:52Z","timestamp":1699484812000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9833711\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5]]},"references-count":78,"URL":"https:\/\/doi.org\/10.1109\/sp46214.2022.9833711","relation":{},"subject":[],"published":{"date-parts":[[2022,5]]}}}