Cybersecurity glossary
What are XS-Leaks?
Learn what XS-Leaks are, how cross-site oracles infer private user state, which browser and application defenses help, and how to review products against common XS-Leak patterns.
Definition
XS-Leaks (cross-site leaks) are a family of web attacks that infer private information about a user’s interaction with a victim site by abusing cross-origin side channels—such as timing, framing, caching, or window APIs—without directly reading the victim origin’s DOM.
Why XS-Leaks matter
Classic web defenses focus on injection and request forgery. XS-Leaks ask a quieter question: can an attacker website detect your private state elsewhere? Login detection, inbox identity hints, and resource existence checks can all become oracles.
As browsers tighten third-party cookies, some tracking shifted toward clever cross-site inference. Application security reviews should include these patterns explicitly.
How an XS-Leak attack looks
Choose a private question
Examples: Is the user logged in? Does object ID 55 exist for this user?
Find a state-dependent browser signal
Timing, frameability, cache behavior, error codes, or window references.
Probe from attacker origin
Cross-site navigations, embeds, or loads exercise the victim URL.
Infer the answer
Map the measured signal to the private yes/no or small-value result.
Exploit the insight
Targeted phishing, account correlation, or chaining into other bugs.
Technique families (examples)
Timing leaks
Authenticated pages or database hits change response latency.
Frame / embed leaks
Success or failure of framing reveals path or header differences.
Window reference leaks
Opener/opened relationships disclose navigations across sites.
Error and redirect leaks
Distinct status or redirect targets encode object existence.
Defenses mapped to causes
| Defense | Helps with |
|---|---|
| COOP | Many cross-window and opener-based techniques |
| CSP frame-ancestors | Unwanted embedding and some frame oracles |
| Fetch Metadata policies | Unexpected cross-site resource inclusion |
| SameSite cookies | Credentialed cross-site probing |
| Uniform responses | Existence and auth-state oracles |
| Cross-origin isolation | Certain powerful embed/timing contexts |
Review checklist
- Identify URLs whose behavior changes with auth or object ownership.
- Deploy Cross-Origin-Opener-Policy on sensitive origins.
- Ensure framing policy is intentional and consistent.
- Normalize error pages and redirects that reveal existence.
- Use Sec-Fetch-* allowlists for state-changing and sensitive GETs where appropriate.
- Retest after introducing new microfrontends or preview embeds.
- Read xsleaks.dev classes relevant to your stack each release cycle.
- File one-bit privacy leaks with the same seriousness as data exfiltration bugs.
The practical takeaway
XS-Leaks are cross-site side-channel techniques that infer private user state without reading another origin’s DOM. They turn browser signals into privacy and security oracles.
Defend with isolation headers, consistent responses, Fetch Metadata, and SameSite—and review products against the XS-Leaks catalog, not only against XSS and CSRF.
Related security terms
Cross-Origin Information Leak
Broader concept of unintended cross-origin disclosure that XS-Leaks instantiate.
Cross-Origin Opener Policy (COOP)
Key isolation control against many window-based XS-Leak techniques.
Fetch Metadata
Request metadata useful for rejecting abusive cross-site loads.
SameSite Cookie
Limits credentialed cross-site requests that power many oracles.
Frequently asked questions
What are XS-Leaks in simple terms?
They are tricks that let one website guess private facts about your session on another website—like whether you are logged in—by measuring side effects instead of reading the page.
Who maintains the XS-Leaks catalog?
The community-maintained XS-Leaks project documents techniques and mitigations at xsleaks.dev and related research.
Are XS-Leaks browser bugs?
Some rely on browser platform behaviors; others rely on application design choices that create strong oracles. Fixes often require both.
What is an oracle in this context?
A measurable difference that answers a private question, such as ‘did this authenticated URL return quickly?’ or ‘could this page be framed?’
Do SameSite cookies stop all XS-Leaks?
They reduce many credentialed cross-site probes but do not eliminate every technique, especially those not relying on cookies.
How should teams start defending?
Deploy COOP on sensitive apps, control framing, uniformize error/redirect behavior, use Fetch Metadata allowlists, and review high-value state URLs against known XS-Leak classes.
Are XS-Leaks theoretical only?
No. Researchers and bug bounty programs regularly demonstrate practical cross-site state inference against real products.
References
Explore authoritative guidance and frameworks related to xs-leaks.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.