{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:03:31Z","timestamp":1782975811938,"version":"3.54.5"},"reference-count":85,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100000923","name":"Australian Research Council (ARC) Laureate Fellowship","doi-asserted-by":"publisher","award":["FL230100033"],"award-info":[{"award-number":["FL230100033"]}],"id":[{"id":"10.13039\/501100000923","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00187","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"1785-1803","source":"Crossref","is-referenced-by-count":0,"title":["KeyChaser: Unveiling API Keys in Browser Extensions"],"prefix":"10.1109","author":[{"given":"Shijin","family":"Chen","sequence":"first","affiliation":[{"name":"Institute of Cybersecurity and Cryptology (iC), School of Computing and Information Technology, University of Wollongong,Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Willy","family":"Susilo","sequence":"additional","affiliation":[{"name":"Institute of Cybersecurity and Cryptology (iC), School of Computing and Information Technology, University of Wollongong,Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yudi","family":"Zhang","sequence":"additional","affiliation":[{"name":"Institute of Cybersecurity and Cryptology (iC), School of Computing and Information Technology, University of Wollongong,Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Fuchun","family":"Guo","sequence":"additional","affiliation":[{"name":"Institute of Cybersecurity and Cryptology (iC), School of Computing and Information Technology, University of Wollongong,Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Google begins testing extension manifest v3 in chrome canary","author":"Abrams","year":"2019"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560685"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670339"},{"key":"ref4","volume-title":"Api gateway api key file format","year":"2026"},{"key":"ref5","volume-title":"Best practices for managing aws access keys","year":"2025"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/2245276.2232005"},{"key":"ref7","article-title":"Protecting browsers from extension vulnerabilities","volume-title":"NDSS","author":"Barth"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM56168.2023.10304853"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SecDev53368.2022.00026"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00141"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607236"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2046753"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179338"},{"key":"ref14","first-page":"97","article-title":"An evaluation of the google chrome extension security architecture","volume-title":"21st USENIX Security Symposium (USENIX Security 12)","author":"Carlini"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CNS.2016.7860481"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243823"},{"key":"ref17","volume-title":"Manifest v2 support timeline","year":"2021"},{"key":"ref18","volume-title":"Trustworthy chrome extensions","year":"2018"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3579856.3590329"},{"key":"ref20","article-title":"Malicious browser extensions at scale: Bridging the observability gap between web site and browser","volume-title":"10th USENIX Workshop on Cyber Security Experimentation and Test","author":"DeKoven"},{"key":"ref21","volume-title":"Deepseek data leak exposes 12k hardcoded api keys and passwords","author":"Divya","year":"2025"},{"key":"ref22","volume-title":"Google chrome extensions to be officially released","author":"Edwards","year":"2009"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00009"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3477314.3507098"},{"key":"ref25","volume-title":"Espree","year":"2025"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484745"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510150"},{"key":"ref28","volume-title":"Gitguardian","year":"2025"},{"key":"ref29","volume-title":"Gitleaks","year":"2025"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/2414456.2414461"},{"key":"ref31","volume-title":"Chrome web store","year":"2023"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179471"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3660818"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/MSR59073.2023.00051"},{"key":"ref35","first-page":"641","article-title":"Hulk: Eliciting malicious behavior in browser extensions","volume-title":"23rd USENIX Security Symposium (USENIX Security 14)","author":"Kapravelos"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24383"},{"key":"ref37","first-page":"735","article-title":"Unleash the simulacrum: shifting browser realities for robust {Extension-Fingerprinting} prevention","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Karami"},{"key":"ref38","first-page":"7055","article-title":"Extending a hand to attackers: browser privilege escalation attacks via extensions","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Kim"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.5220\/0011983600003464"},{"key":"ref40","first-page":"2527","article-title":"Pushed by accident: A {Mixed-Methods} study on strategies of handling secret information in source code repositories","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Krause"},{"key":"ref41","first-page":"2507","article-title":"Fingerprinting in style: Detecting browser extensions via injected style sheets","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Laperdrix"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40203-6_4"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/saner64311.2025.00058"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.5220\/0010238101450159"},{"key":"ref45","volume-title":"Secretfinder","year":"2025"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/359205.359226"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23418"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.14722\/diss.2018.23009"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23092"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645683"},{"key":"ref51","first-page":"2133","article-title":"{CodexLeaks}: Privacy leaks from code generation language models in {GitHub} copilot","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Niu"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1145\/3634737.3656999"},{"key":"ref53","volume-title":"Openai api","year":"2020"},{"key":"ref54","volume-title":"Meet trufflehog - a browser extension for finding secret keys in javascript code","author":"Osborne","year":"2021"},{"key":"ref55","first-page":"3747","article-title":"{FV8}: A forced execution {JavaScript} engine for detecting evasive techniques","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Pantelaios"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3423343"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00033"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-10109-y"},{"key":"ref59","volume-title":"Api key best practices","year":"2026"},{"key":"ref60","first-page":"32","article-title":"Stronger password authentication using browser extensions","volume-title":"USENIX Security Symposium","volume":"17","author":"Ross"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/COMSNETS48256.2020.9027350"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.09.003"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2015.48"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23309"},{"key":"ref65","volume-title":"whispers","year":"2025"},{"key":"ref66","first-page":"717","article-title":"The dangers of human touch: fingerprinting browser extensions through user actions","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Solomos"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560576"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00058"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2016.52"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3038912.3052596"},{"key":"ref71","volume-title":"Desktop browser market share worldwide","year":"2025"},{"key":"ref72","volume-title":"Toyota discloses data leak after access key exposed on github","author":"Toulas","year":"2022"},{"key":"ref73","volume-title":"Trufflehog","year":"2025"},{"key":"ref74","volume-title":"74% of publicly leaked keys are never revoked","year":"2024"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1145\/2591971.2592003"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2021.3081867"},{"key":"ref77","first-page":"6007","article-title":"Credit karma: Understanding security implications of exposed cloud services through automated capability inference","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Wang"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom56396.2022.00028"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/APSEC.2018.00040"},{"key":"ref80","first-page":"4607","article-title":"Arcanum: detecting and evaluating the privacy risks of browser extensions on web pages and web content","volume-title":"33rd USENIX Security Symposium (USENIX Security 24)","author":"Xie"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616584"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616591"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00122"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1145\/2766498.2766499"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00009"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573532.pdf?arnumber=11573532","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:35:59Z","timestamp":1782970559000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573532\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":85,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00187","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}