Beware of Finer-Grained Origins

The security policy of browsers provides no isolation between documents from the same origin (scheme, host, and port), even if those documents have different security characteristics. We show how this lack of isolation leads to origin contamination vulnerabilities in a number of browser security features, such as cookies, encryption, and code signing. A tempting approach to fixing these vulnerabilities is to refine the browser’s notion of origin, leveraging the browser’s built-in isolation between security contexts. We demonstrate that attackers can circumvent these “finergrained origins” using the library import and data export features of browsers. We discuss several approaches to preventing these attacks.