thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Cross-Site Leaks (XS-Leaks)

Browser side-channel attacks that infer a user's state on another site, such as whether they are logged in or a search returned results.

Definition

Techniques observe side effects like frame counts, timing, error events or cache behavior. Defenses include SameSite cookies, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Fetch Metadata request headers checks and framing protections.

Example

A malicious page detects whether a victim's search on a webmail site found any messages by measuring response timing.

Exam tip

Defenses are mostly browser isolation headers and SameSite cookies.

Related terms