AI
The Problem Privacy Sandbox Was Built to Solve
Third-party cookies track users across sites for conversion measurement. Browsers started phasing them out over privacy concerns, and legislation reinforced that. Network-level ad blockers added pressure. Google built Privacy Sandbox as a replacement with three parts: client-side JavaScript APIs in Chrome and Chromium, a walled garden requiring ad platforms to register with Google, and trusted execution environments for aggregate analytics. Google reversed its full deprecation plan in April 2025. Privacy Sandbox still runs in Chrome and Microsoft Edge, and ad tech companies still rely on it.
How the Attribution Reporting API Tracks Conversions
The Attribution Reporting API replaces cookie-based conversion tracking entirely on the client side. When a user views an ad, the browser sends an attribution-reporting-eligible header to the ad server, which responds with a register-source header naming the destination site and storing metadata in the browser. When the user later makes a purchase, a trigger fires. The browser matches the trigger to the stored source and sends an event-level report back to the ad server. Reports include limited data and go out at randomized times, preventing individual-level tracking.
Debug Reports Bypass Safe Frame Protections
Privacy Sandbox built in debug reports as a “transitional” escape hatch, tied to cookie deprecation. That deprecation never happened, making them permanent. Safe Frame, the IAB’s hardened iframe standard used by Google DoubleClick, relies on a no-referrer policy to hide which publisher site served an ad. But enabling the Attribution Reporting API on a page causes debug reports to send the top-level site anyway, even with no-referrer set. An attacker who buys a Google ad can serve a malformed attribution-reporting response header, trigger a header-error debug report, and link individual IP addresses to the sites where those ads appeared.
Destination Hijacking via Unregistered Debug Domains
The Attribution Reporting API lets a single ad source register up to three destination sites. On a tech publishing site, Lim found that Google DoubleClick injected two extra destinations onto every ad: debug-conversion-domain-one.com and debug-conversion-domain-two.com. Google hadn’t registered either. He bought both for roughly $20. Because DoubleClick added them to every ad across its network, Lim’s attacker-controlled domains received attribution events for any user who saw a DoubleClick ad. An undocumented per-destination rate limit of 1,000 event-level reports acts as a boolean oracle: if the user previously visited the advertised site, 999 slots are consumed; if not, all 1,000 remain.
Shared Storage Worklets and Cohort Data Leakage
The Shared Storage API stores cross-site user cohort data (interest groups, A/B test buckets) without exposing it directly. Data can only leave through a worklet output gate: a function returning a selected URL. Output goes to a fenced frame, opaque to the publisher. But the API allows cross-origin worklet loading. Criteo’s experimental fledge.io worklet code used an endsWith string match on a URL list to pick which ad to show. Passing the full range of possible Chrome A/B population values as URL fragments to that worklet revealed the stored cohort value from shared storage.
Privacy-Preserving Ad Tech Is an Oxymoron
The Privacy Sandbox team built serious protections, but satisfying advertising platforms and privacy requirements at once forced trade-offs that became escape hatches. Three Privacy Sandbox APIs (topics, protected audience, and private aggregation) remain unfuzzed. The aggregation service, which ad platforms run in their own cloud accounts to decrypt analytics data, is another open question. Enrollment attestations using public keys may also be bypassable. The attack surface is large and under-researched. Ad tech makes up a significant share of internet traffic today. Few security researchers look at it.
Notable Quotes
deprecated. Well, good luck with that Eugene “spaceraccoon” Lim · ▶ 12:10
what’s wrong with these domains? Eugene “spaceraccoon” Lim · ▶ 18:45
it was debugging, right? Right? So I bought Eugene “spaceraccoon” Lim · ▶ 19:04
preserving um ad tech is an oxymoron um Eugene “spaceraccoon” Lim · ▶ 31:01
Key Takeaways
- Debug reports in the Attribution Reporting API permanently leak top-level site despite Safe Frame’s no-referrer protections.
- Buying two unregistered Google DoubleClick debug domains for $20 enabled network-wide browsing history reconstruction.
- Insecure cross-origin worklets in Criteo’s experimental code exposed shared storage cohort data to any attacker.
- Privacy Sandbox’s competing stakeholder demands produce exploitable escape hatches, and most of the API surface remains unresearched.
About the Speaker(s)
Eugene “spaceraccoon” Lim is a security researcher and white hat hacker based in Singapore. He focuses on application security in his day job at a 200-person organization and conducts independent vulnerability research across hardware, software, and web technologies, including internet-connected consumer devices. His work has been featured at Black Hat, DEF CON, and in publications including WIRED and The Register.