Two New Ways to Exploit a Fixed Browser Fingerprinting Flaw
No ratings
Presented at BSidesMunich 2019 by
Fingerprinting issues in web browsers are a complex matter. There are so many ways to fingerprint users, and most fingerprint tricks are very hard or impossible to mitigate. Also, fingerprinting issues have much lower impact on users, compared with high-severity issues like RCE, UXSS. For these reasons, browser vendors usually do not fix fingerprinting issues. However, there is one fingerprinting issue that Chrome did fix. That fingerprinting issue is not new and was fixed long time ago. However, I later discovered two different ways to bypass the original fix. This talk will first briefly review the original fingerprinting issue, and then focus on discussing the details of the two bypasses, and the relevant patches. One bypass has been fixed in all major browsers, but another is still unfixed. A short demo using the unfixed bypass will be shown.