{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T20:10:54Z","timestamp":1783973454388,"version":"3.55.0"},"reference-count":73,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100003725","name":"National Research Foundation of Korea","doi-asserted-by":"publisher","award":["RS-2026-25470691"],"award-info":[{"award-number":["RS-2026-25470691"]}],"id":[{"id":"10.13039\/501100003725","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00241","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"1804-1821","source":"Crossref","is-referenced-by-count":0,"title":["Site Isolation is Dead: How Site Isolation is Broken in Agentic Browsers and Extensions"],"prefix":"10.1109","author":[{"given":"Suyoung","family":"Lee","sequence":"first","affiliation":[{"name":"KAIST"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Seongho","family":"Keum","sequence":"additional","affiliation":[{"name":"KAIST"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Changoo","family":"Lee","sequence":"additional","affiliation":[{"name":"KAIST"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Dongwon","family":"Shin","sequence":"additional","affiliation":[{"name":"KAIST"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sanghyun","family":"Hong","sequence":"additional","affiliation":[{"name":"Oregon State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Byoungyoung","family":"Lee","sequence":"additional","affiliation":[{"name":"Seoul National University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Sooel","family":"Son","sequence":"additional","affiliation":[{"name":"KAIST"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"1688 AIBUY"},{"key":"ref2","volume-title":"Bardeen"},{"key":"ref3","volume-title":"Browse AI"},{"key":"ref4","volume-title":"BrowserOS"},{"key":"ref5","volume-title":"CVEdetails"},{"key":"ref6","volume-title":"Deta Surf"},{"key":"ref7","volume-title":"Do Browser"},{"key":"ref8","volume-title":"HARPA AI"},{"key":"ref9","volume-title":"The internet is better on comet"},{"key":"ref10","volume-title":"Nanobrowser"},{"key":"ref11","volume-title":"Nanobrowser GitHub"},{"key":"ref12","volume-title":"Sider"},{"key":"ref13","volume-title":"Thunderbit"},{"key":"ref14","volume-title":"Vibe"},{"key":"ref15","volume-title":"WebPilot"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833711"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/MALWARE.2013.6703693"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690350"},{"key":"ref19","volume-title":"Adam Barth. The web origin concept","year":"2011"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1145\/1516046.1516066"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/1755913.1755942"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315248"},{"key":"ref23","article-title":"Chrome for developers","volume-title":"Content scripts","year":"2012"},{"key":"ref24","article-title":"Chrome for developers","volume-title":"Message passing","year":"2012"},{"key":"ref25","volume-title":"Chrome for developers. Message sender","year":"2024"},{"key":"ref26","volume-title":"Chrome for developers. chrome.storage","year":"2025"},{"key":"ref27","volume-title":"Chromium Docs. Process model and site isolation"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.52202\/079017-2636"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24188"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484745"},{"key":"ref31","volume-title":"Eko"},{"key":"ref32","article-title":"Anny Gakhokidze","volume-title":"Introducing Firefox\u2019s new site isolation security architecture","year":"2021"},{"key":"ref33","volume-title":"Introducing site isolation in firefox","author":"Gakhokidze","year":"2021"},{"key":"ref34","volume-title":"Gemini in Chrome - AI assistance, right in your browser","year":"2025"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3605764.3623985"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671646"},{"key":"ref37","first-page":"445","article-title":"Detecting and characterizing lateral phishing at scale","volume-title":"Proceedings of the USENIX Security Symposium","author":"Ho","year":"2019"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3719027.3765064"},{"key":"ref39","volume-title":"Magical"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.1435"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978414"},{"key":"ref42","first-page":"1008","article-title":"FuzzOrigin: Detecting UXSS vulnerabilities in browsers through origin fuzzing","volume-title":"Proceedings of the USENIX Security Symposium","author":"Kim","year":"2022"},{"key":"ref43","first-page":"7055","article-title":"Extending a hand to attackers: Browser privilege escalation attacks via extensions","volume-title":"Proceedings of the USENIX Security Symposium","author":"Min Kim","year":"2023"},{"key":"ref44","volume-title":"Mariko Kosaka. Inside look at modern web browser (part 1)","year":"2018"},{"key":"ref45","author":"Lee","year":"2025","journal-title":"V8 Sandbox Bypass: ARR\/W by sig confusion in WasmToJsWrapper tier-up with in-sandbox Tuple2 corruption"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3706598.3714025"},{"key":"ref47","article-title":"RedTeamCUA: Realistic adversarial testing of computer-use agents in hybrid web-os environments","author":"Liao","year":"2025","journal-title":"CoRR, abs\/2505.21936"},{"key":"ref48","article-title":"AutoDAN: Generating stealthy jailbreak prompts on aligned large language models","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Liu","year":"2024"},{"key":"ref49","volume-title":"The chromium super (inline cache) type confusion","author":"Yue Mo","year":"2022"},{"key":"ref50","article-title":"Analysis of UXSS exploits and mitigations in chromium","volume-title":"Technical report","author":"Moroz","year":"2019"},{"key":"ref51","volume-title":"NVD - CVE-20250291","year":"2025"},{"key":"ref52","volume-title":"ChatGPT atlas","year":"2025"},{"key":"ref53","article-title":"The Chromium Projects","volume-title":"Site isolation"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/1519065.1519090"},{"key":"ref55","first-page":"1661","article-title":"Site isolation: Process separation for web sites within the browser","volume-title":"Proceedings of the USENIX Security Symposium","author":"Reis","year":"2019"},{"key":"ref56","first-page":"713","article-title":"Same-origin policy: Evaluation in modern browsers","volume-title":"Proceedings of the USENIX Security Symposium","author":"Schwenk","year":"2017"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690291"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.35"},{"key":"ref59","first-page":"2917","article-title":"Can i take your subdomain? exploring same-site attacks in the modern web","volume-title":"Proceedings of the USENIX Security Symposium","author":"Squarcina","year":"2021"},{"key":"ref60","article-title":"The Chromium Authors","volume-title":"Mojo"},{"key":"ref61","volume-title":"Multi-process architecture"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1145\/3713082.3730378"},{"key":"ref63","volume-title":"Indexed database api 3.0","year":"2025"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.emnlp-main.104"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.52202\/079017-0817"},{"key":"ref66","article-title":"GuardAgent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Xiang","year":"2025"},{"key":"ref67","article-title":"AdvAgent: Controllable blackbox red-teaming on web agents","volume-title":"Proceedings of the International Conference on Machine Learning","author":"Xu","year":"2025"},{"key":"ref68","article-title":"Toward principled browser security","volume-title":"Proceedings of the Workshop on Hot Topics in Operating Systems","author":"Yang","year":"2013"},{"key":"ref69","article-title":"Language agents as hackers: Evaluating cybersecurity skills with capture the flag","volume-title":"Proceedings of the Multi-Agent Security Workshop","author":"Yang","year":"2023"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00123"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3690624.3709179"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.624"},{"key":"ref73","article-title":"Webarena: A realistic web environment for building autonomous agents","volume-title":"Proceedings of the International Conference on Learning Representations","author":"Zhou","year":"2024"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573584.pdf?arnumber=11573584","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T20:01:23Z","timestamp":1783972883000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573584\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":73,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00241","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}