AI
The Privacy Sandbox and the Cookie Phaseout
Third-party cookies are phasing out. Legislation like GDPR reduced what companies can collect, and consumers use ad blockers and Pi-holes. Google announced in 2022 it would replace third-party cookies with Privacy Sandbox APIs, but in 2025 reversed course. The APIs remain active in all Chrome and Chromium browsers, including Edge. Facebook, LinkedIn, and other ad platforms still call them. Declining the cookie consent popup on a website doesn’t stop this tracking.
How the Attribution API Tracks Conversions
The Attribution API solves ad conversion tracking without third-party cookies. When you view an ad, the browser asynchronously pings the ad server, which responds with a JSON payload including the intended destination. When you later visit that destination or make a purchase, a second request fires, the browser matches it against stored source data, and sends a confirmation back. This flow runs entirely in browser context, not in the page’s JavaScript, which creates unexpected behavior.
Reading the Walled Garden from the Inside
Lim registered for Privacy Sandbox access using a Google form (Google was still accepting individuals at the time, but has since suspended his account). He found the attestation GitHub repo, which lists hundreds of enrolled companies, and iterated through each to check their attestation files. The GitHub documentation contained information absent from Google’s public site, including TODO notes that pointed to unresolved design gaps. Visiting any news site with Chrome’s attribution debug tab open reveals live source registrations, destinations, and debug keys for any active viewer.
Debug Reports and Cross-Site Leaks
The Attribution API includes debug reports as a “transitional” escape hatch. They were meant to last until third-party cookies disappeared, but that never happened. Debug reports bypass no-referrer header protections, leaking the top-level site to third-party origins. Lim also found the Attribution API bypasses Safe Frame, the hardened iframe standard that publishers use to prevent ad code from learning which site is displaying it. New browser capabilities frequently invalidate assumptions baked into older web standards.
Destination Hijacking and the Rate-Limit Oracle
Scanning Google DoubleClick ad traffic, Lim noticed every ad injected two extra conversion destinations: debugconversion1.com and debugconversion2.com. Both were unregistered. He bought them for about $10 each. The useful exploit came from an undocumented 1,000-report rate limit per destination. If a target user performed a conversion on the real site, one report fires toward that site, leaving 999 remaining for the attacker’s domains. By sending 999 trigger requests, Lim could determine whether that user had visited the target site, building a boolean oracle for browsing history.
Notable Quotes
Yeah, they I could buy them for like 10 Eugene “spaceraccoon” Lim · ▶ 22:43
super interesting. I wanted to violate Eugene “spaceraccoon” Lim · ▶ 23:00
an oxymoron. It’s really really hard. Eugene “spaceraccoon” Lim · ▶ 25:12
Key Takeaways
- Google DoubleClick ads injected unregistered destination domains buyable for $10, enabling privacy attacks.
- An undocumented rate limit of 1,000 reports per destination allows boolean inference of a user’s browsing history.
- Debug reports meant to ease the cookie transition bypass no-referrer protections and remain active indefinitely.
About the Speaker(s)
Eugene Lim is a security researcher and white hat hacker. From Amazon to Zoom, he has helped secure applications from a range of vulnerabilities. His work has been featured at top conferences such as Black Hat, DEF CON, and industry publications like WIRED and The Register.