AI
URL Protocol Handlers as a Browser Attack Surface
Any installed app can register a custom URL scheme. Steam registers steam://. Zoom registers zoommtg://. Windows Settings registers ms-settings://. The scheme goes into the OS registry and points to an executable. When a browser hits that scheme, it hands off to the app. That handoff is what creates the attack surface.
The browser has no way to silently check whether a scheme exists without attempting to load it. That attempt produces different behavior depending on whether the handler is registered or not — and JavaScript can measure the difference. Satoki Tsuji found three separate ways to read that signal from any webpage a victim visits.
Attacker Scenarios: Phishing, Profiling, and Cross-Site Tracking
Knowing which apps are installed turns a generic phishing page into a targeted one. If a script silently detects the Steam scheme on a visitor’s machine, it can render a fake Steam login overlay. The victim sees a UI they recognize and trust. The attacker never needs to guess. The same fingerprint works for profiling: Instagram, Spotify, Steam, and Twitch present but no antivirus tool means young, undefended, and worth targeting with a malware payload built for that exact gap. The third abuse is cross-site tracking. Two sites that see the same protocol pattern — say, the same five custom schemes present and the same three absent — can treat their visitors as one person, breaking same-site origin boundaries without cookies.
Zero-Day 1: Firefox window.open Locus Technique (CVE-2024-9398)
CVE-2024-9398 exploits a single behavioral difference in Firefox: window.open against a registered protocol (like ms-settings) creates an about:blank page the script can access, while an unregistered scheme hits a cross-origin error page. That gap is enough to confirm whether any protocol is installed. Tsuji named it the “locus technique.” A Python Flask PoC (11:44) proved it — window.open calls fired, each window immediately closed, and the results matched the desktop: Slack, Spotify, Steam, and Zoom MTG all confirmed. The visible popup problem disappears with a sandboxed iframe, which blocks the dialog entirely and makes enumeration silent.
Zero-Day 2: Image Tag Timing Oracle (CVE-2024-5690)
CVE-2024-5690 measures how long an <img> tag takes to fire onerror when pointed at a custom protocol. A registered scheme runs through extra checks before failing — about 6,000 ms for ms-settings. An unregistered one fails in around 30,000 ms. Both show the same broken-image icon. The difference is invisible to the user.
“Uh this method completely silent not popup not prompt.” — Satoki Tsuji
The CVE-2024-5690 timing-oracle PoC demo (16:15) checks protocols one by one — FTP, mailto, Slack, Spotify, Steam, Zoom MTG — matching the installed apps exactly. The trade-off is speed: each probe takes seconds, so enumerating every possible scheme is slow.
Zero-Day 3: CSP Report-URI as a Protocol Oracle
CSP’s report-uri sends a JSON violation report to a server whenever a page blocks a forbidden resource. Tsuji pointed that URL at an attacker-controlled server, then loaded image tags with custom protocol schemes under a strict img-src 'self' policy. A registered protocol triggers a CSP violation and fires a report. An unknown scheme triggers nothing — Firefox skips CSP enforcement because it knows the resource won’t load. That skip is the oracle.
“we uh turn the security features and CSP reporting uh into an oracles” — Satoki Tsuji
The CSP report-URI PoC demo (22:27) identifies Slack, Spotify, Steam, and Zoom MTG in a single HTTP burst — the fastest of the three methods, because each report is just a POST with no timing delay.
Notable Quotes
protocol handers uh can accidentally expose sensitive datas in way seriously fast and dangerous Satoki Tsuji · ▶ 0:29
that tiny difference that become oracles Satoki Tsuji · ▶ 8:19
Uh this method completely silent not popup not prompt Satoki Tsuji · ▶ 16:41
we uh turn the security features and CSP reporting uh into an oracles Satoki Tsuji · ▶ 22:09
Key Takeaways
- Probe any URL scheme silently from a webpage to fingerprint which apps a visitor has installed.
- Three distinct browser oracles — window.open error pages, image timing deltas, and CSP reports — all expose the same installation state.
- Disable or block custom protocol handlers in hardened browser profiles to eliminate this cross-site tracking vector.
About the Speakers
Satoki Tsuji
Cybersecurity Enthusiast, CTF Player and Bug Hunter. Contributed to the organization of SECCON CTF, took the stage at AVTOKYO2020/2023/2024, Security Analyst Summit 2024, Hack Fes. 2024, and competed in the DEF CON CTF Finals. Renowned for uncovering and reporting vulnerabilities in web services and softwares including Google and Firefox.
Yuichi Sugiyama
Yuichi Sugiyama is a security researcher working across software and hardware. His fuzzing work spans algorithmic improvements and applications from IoT devices to CPU design.