Back to Web vulnerabilities. Corpus-wide selection and extraction notes are on corpus. Citations use the shared bibliography; this page adds no keys of its own. No discussion block on this page — comments belong on the content page.

• Run date: 2026-08-27 (UTC).
• Drain item: security:web_vulnerabilities (new), store id 224, run 62, claimed by cursor-drain-webvuln. Executed as Cursor, not via claude -p / drain-sandbox.sh.
• Review models requested by this sitting: GPT 5.6 Luna medium (gpt-5.6-luna-medium) for the three focused passes and the generic pass, instead of the spec's sonnet/fable split. Logged here so a later reader does not assume the default mix.
• Corpus at run time: 5,859 extracted papers, 2010–2026, CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P. Read-only inputs under /workspace/publications_dataset/data/.
• Read first: the wiki-measuretheweb spec (audience, currency, 5,859-paper corpus, provenance page, start link, bibtex), corpus, security, ethics, notifying_websites, javascript, foxhound, interaction, live start (already promised Web vulnerabilities).
• Target pages had no revision (core.getPageInfo “does not exist”). dw.mjs pages does not list provenance:. ?do=export_raw on a missing page returns an HTML error document — that is not an existence test. This is a creation, not an extension.
• Live start (rev 1787836787) already links the child; this sitting does not edit start. Live security (rev 1787835259) still says all five children are red links — WRAP updated to name this child as written. Live VirusTotal does not exist; the local draft of that page is not this item and is not claimed live.
• No write to the publication mount. Wiki saves through scripts/dw.mjs (JSON-RPC only). Live literature:bibliography was re-exported immediately before append (rev 1787836782), not taken from a stale local copy. The live bibliography already has a stray extra } after [1Stock, Ben; Johns, Martin; Steffens, Marius; Backes, Michael (2017): "How the Web Tangled Itself: Uncovering the History of Client-Side Web (In) Security", in: 26th USENIX Security Symposium (USENIX Security 17), pp. 971-987. USENIX Association, Vancouver, BC. (Link)]; this sitting does not “fix” it.
• Hosted code: pages/count_vuln_sites.py (--demo / --selftest both run). Report: scripts/report_web_vulnerabilities.mjs. Role map: scripts/vuln_fold.mjs. Figure check: scripts/verify_web_vuln_figures.mjs. External re-fetch: scripts/external_checks_web_vuln.sh.

A reasonable person might have treated the 99 as the population. That is the mistake the parent cell already forbids. Another might have written a nuclei/ZAP tool page; full-text union of nuclei/nikto/w3af/openvas is 24 papers — residue here, not a page (already rejected on security).

All counts are papers unless labelled tuples. Sentinels are not answers. Four corpus papers have no paper.cols.txt; none of the 99 are among those four.

Membership of the 99 is mechanical: a used or produced classification.target == vulnerability tuple, platforms includes web, and the paper is in POPULATIONS.crawled. scripts/report_web_vulnerabilities.mjs exits 1 if that conjunction and the ROLE map disagree.

Do not treat 880 or 99 as a method count. The 30 is the in-the-wild population.

• ROLE (scripts/vuln_fold.mjs): one label per paper of the 99. Deciding sentence inline, quote-checked against paper.cols.txt. The report throws if a key of the 99 is missing from ROLE or ROLE contains a key that is not in the 99.
• Kind fold: ordered regex families over title, slug and vulnerability tuples; multi-label. Residue 62 of 99 is printed in full in the report block below. Clickjacking as a primary study is essentially absent from this schema slice (1 of 99, 0 wild).
• Archive-surface split (added after generic review): two keys, not a regex — CCS/2017/rewriting-history and USENIX/2017/how-the-web-tangled-itself. White Rabbit also reports archived redirects as a second experiment; it stays in the 28 because the crawl was then-live. The report throws if the two sets do not partition the 30.
  • USENIX/2010/searching-the-searchers-with-searchaudit → wild (SQL error oracle on live search engines), not lab.
  • PETS/2023/comparing-large-scale-privacy-and-security-notifications → wild (they notified live operators about findings from a crawl), not offtopic.
  • CCS/2024 login-interface poster → wild (ZAP on live login pages) and counted in the 30; a methods-compression caveat sits on the page.
  • CCS/2017/rewriting-history → wild (archived web as the measurement surface).
  • Lauinger et al. (NDSS 2017 outdated JS) → cve, not wild: library version ≠ origin exploitable.
  • Spider-Scents and Black Widow → lab.

Wild keys (30):

• CCS/2013/25-million-flows-later-large-scale-detection-of-dom-based-xss
• CCS/2015/from-facepalm-to-brain-bender-exploring-client-side-cross-site-scripting
• CCS/2017/rewriting-history-changing-the-archived-web-from-the-present
• CCS/2021/out-of-sight-out-of-mind-detecting-orphaned-web-pages-at-internet-scale
• CCS/2022/distinct-identity-theft-using-in-browser-communications-in-dual-window-single-si
• CCS/2024/poster-security-of-login-interfaces-in-modern-organizations
• CCS/2025/in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the
• IEEE-SP/2019/empoweb-empowering-web-applications-with-browser-extensions
• IEEE-SP/2022/the-state-of-the-samesite-studying-the-usage-effectiveness-and-adequacy-of-sames
• IEEE-SP/2022/towards-automated-auditing-for-account-and-session-management-flaws-in-single-si
• IEEE-SP/2023/its-dom-clobbering-time-attack-techniques-prevalence-and-defenses
• IEEE-SP/2024/the-great-request-robbery-an-empirical-study-of-client-side-request-hijacking-vu
• IEEE-SP/2025/403-forbidden-ethically-evaluating-broken-access-control-in-the-wild
• NDSS/2013/the-postman-always-rings-twice-attacking-and-defending-postmessage-in-html5-webs
• NDSS/2019/dont-trust-the-locals-investigating-the-prevalence-of-persistent-client-side-cross-site-scripting-in-the-wild
• NDSS/2022/auto-draft-207 (Kang, Li, Cao — Probe the Proto; DOI 10.14722/ndss.2022.24308, not the auto-draft URL)
• NDSS/2025/do-not-follow-the-white-rabbit-challenging-the-myth-of-harmless-open-redirection
• NDSS/2025/misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shortening-service
• NDSS/2026/dom-xss-detection-via-webpage-interaction-fuzzing-and-url-component-synthesis
• PETS/2023/comparing-large-scale-privacy-and-security-notifications
• USENIX/2010/searching-the-searchers-with-searchaudit
• USENIX/2014/precise-client-side-protection-against-dom-based-cross-site-scripting
• USENIX/2014/ssoscan-automated-testing-of-web-applications-for-single-sign-on-vulnerabilities
• USENIX/2017/how-the-web-tangled-itself-uncovering-the-history-of-client-side-web-in-security
• USENIX/2020/cached-and-confused-web-cache-deception-in-the-wild
• USENIX/2022/web-cache-deception-escalates
• USENIX/2023/a-large-scale-measurement-of-website-login-policies
• USENIX/2023/extending-a-hand-to-attackers-browser-privilege-escalation-attacks-via-extension
• USENIX/2024/dancer-in-the-dark-synthesizing-and-evaluating-polyglots-for-blind-cross-site-sc
• USENIX/2025/the-domino-effect-detecting-and-exploiting-dom-clobbering-gadgets-via-concolic-e

Lab / cve / offtopic keys are the rest of ROLE in scripts/vuln_fold.mjs (27 / 8 / 34).

ROLE deciding quotes: 68 exact / 31 partial (60% five-word-window threshold, hyphen-break normalised) / 0 below, of 99. Below-threshold would have failed the report. Partial is the usual column-splice, not an unsupported claim.

Cover-paper figures on the content page were additionally grepped in paper.cols.txt by scripts/verify_web_vuln_figures.mjs: 45 literals, 0 missing (Lekies, Steffens, Bau, Son, Chehade, Kang, clobbering, request robbery, Dancer, SameSite, Black Widow). Presence is not pairing; the pairings were read in the detection.prevalence sentences in report section L.

out/authors.json for Cached and Confused was hand-fixed: the HTML parser had emitted KU Leuven as an author. Live authors used: Seyed Ali Mirheidari, Sajjad Arshad, Kaan Onarlioglu, Bruno Crispo, Engin Kirda, William Robertson.

Fetched 2026-08-27 by scripts/external_checks_web_vuln.sh (exits 1 on any miss):

Rejected (so the next sitting does not re-add them):

• OWASP Top 10 2017 A7 as the current XSS letter — superseded 2021 (A03) and 2025 (A05).
• Chromium XSS Auditor as a 2026 defence to evaluate against.
• A nuclei / nikto / w3af / OpenVAS scanner-tool page — 24 full-text hits, already rejected on security.
• MDN / textbook explanations of X-Frame-Options to pad the clickjacking hole.
• SEO “top web vulnerabilities 2026” listicles.
• Treating 880, 209 or 99 as “papers that measured XSS in the wild”.

• A clickjacking-in-the-wild prevalence from this schema slice. Kind fold: 0 wild, 1 of 99. Full-text 39/857 is an upper bound on mentions.
• A field-wide confirmation rate. Full-text “false positive” / “manually confirm” hits are word counts.
• Whether every wild paper's crawl is how the vulnerability was found — ROLE is a hand reading of the deciding sentence, not a second extraction pass over PDFs.
• Kang et al.'s slug in the index is still auto-draft-207. The DOI used is 10.14722/ndss.2022.24308.
• Spider-Scents stored-XSS counts on 12 known apps are a lab result; they are cited as a detector, not a prevalence.

• Create the promised child rather than widen ethics or javascript.
• Single-label ROLE (a paper cannot be wild and lab). Kind fold is the multi-label one.
• Kind-fold residue of 62 is printed, not collapsed into “other XSS”.
• Quote 37.2% from interaction rather than re-derive a slightly different landing-page share on a different axis.
• Leave the stray } after [1Stock, Ben; Johns, Martin; Steffens, Marius; Backes, Michael (2017): "How the Web Tangled Itself: Uncovering the History of Client-Side Web (In) Security", in: 26th USENIX Security Symposium (USENIX Security 17), pp. 971-987. USENIX Association, Vancouver, BC. (Link)] in the live bibliography.
• Add eight bibliography keys (seven cover papers + Spider-Scents). Collision-checked against the live export: 0 hits.
• count_vuln_sites.py refuses a missing confirmed column (KeyError) rather than defaulting unconfirmed rows to vulnerable.
• The report prints FAILURE to stderr and process.exit(1) — a script that prints FAILURE and exits 0 is not failing loudly.

bau2010_state, son2013_postman, eriksson2021_black, khodayari2022_state, kang2022_probe, khodayari2023_clobbering, mirheidari2020_cached, olsson2024_spider.

Already live and reused: steffens2019_dont, lekies2013_million, chehade2025_forbidden, stock2017web, khodayari2024_great, kirchner2024_dancer, mirheidari2022_cache, hantke2024_redlines, sabino2026_detection, drescher2025_trust, khodayari2025_follow.

pages/count_vuln_sites.py is byte-identical to the <file python count_vuln_sites.py> block. uv run python pages/count_vuln_sites.py –selftest OK. --demo output on 2026-08-27:

findings (rows)                         5
unique URLs                             5
unique hosts                            3
confirmed rows                          3
confirmed unique URLs                   3
confirmed unique hosts                  2
unconfirmed rows                        2
sinks:
  innerHTML	3
  eval	1
  document.write	1
Do not publish unique URLs as sites, or unconfirmed rows as vulnerabilities.

Drafts frozen at out/freeze_web_vuln/ after first publish (content rev 1787838181, provenance rev 1787838183). Three focused GPT 5.6 Luna medium passes ran in parallel against that freeze. The content page was not edited while they ran. No GENERIC_REVIEW placeholder.

Generic pass (no checklist) ran after the focused log was on this page. Content was not edited while it ran.

No GENERIC_REVIEW placeholder.

Command: node scripts/report_web_vulnerabilities.mjs. This is the run the content page was written from.

report_web_vulnerabilities-output.txt

==========================================================================
A. CORPUS
==========================================================================
corpus papers                                       5859
crawled                                             1120
web platform                                        1622
web AND crawled                                     857
missing paper.cols.txt                              4
venues: CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P
years: 2010–2026 (2025–2026 provisional)
 
==========================================================================
B. SCHEMA CONJUNCTION (the 99, not a method count)
==========================================================================
Slice                                         Papers  Share
--------------------------------------------  ------  -----
classification.target=vulnerability any role  883     15.1%
… used/produced                               880     15.0%
… used + web                                  209     23.8%
… used + crawled                              152     17.3%
… used + web + crawled  ← page membership     99      11.3%
… used + offline (multi-label)                433     49.2%
… used + offline-only                         260     29.5%
PUBLISHED_VULN_USED 880
PUBLISHED_VULN_WEB 209
PUBLISHED_VULN_CRAWL 152
PUBLISHED_VULN_WEBCRAWL 99
PUBLISHED_OFFLINE_MULTI 433
PUBLISHED_OFFLINE_ONLY 260
PUBLISHED_OFFLINE_SHARE 49.2%
 
==========================================================================
C. ROLE HAND MAP (scripts/vuln_fold.mjs ROLE)
==========================================================================
Role      Papers of 99  Share of 99  Share of 1120 crawled
--------  ------------  -----------  ---------------------
wild      30            30.3%        2.7%
lab       27            27.3%        2.4%
cve       8             8.1%         0.7%
offtopic  34            34.3%        3.0%
PUBLISHED_WILD 30
PUBLISHED_LAB 27
PUBLISHED_CVE 8
PUBLISHED_OFFTOPIC 34
role sum 99 (must equal 99)
 
==========================================================================
D. KIND FOLD (multi-label; residue printed)
==========================================================================
Kind          Papers of 99  of which wild  of which lab
------------  ------------  -------------  ------------
xss           25            14             11
csrf          7             7              0
clickjacking  1             0              0
sop           4             4              0
sqli          4             0              4
client-other  7             7              0
server-other  6             1              5
kind-fold residue (matched no family): 62
  RESIDUE USENIX/2010/searching-the-searchers-with-searchaudit role=wild title=Searching the Searchers with SearchAudit
  RESIDUE USENIX/2010/securing-script-based-extensibility-in-web-browsers role=offtopic title=Securing Script-Based Extensibility in Web Browsers
  RESIDUE WWW/2010/detection-and-analysis-of-drive-by-download-attacks-and-malicious-javascript-cod role=offtopic title=Detection and analysis of drive-by-download attacks and malicious JavaScript code.
  RESIDUE CCS/2011/fashion-crimes-trending-term-exploitation-on-the-web role=offtopic title=Fashion crimes: trending-term exploitation on the web.
  RESIDUE WWW/2011/heat-seeking-honeypots-design-and-experience role=offtopic title=Heat-seeking honeypots: design and experience.
  RESIDUE USENIX/2014/ssoscan-automated-testing-of-web-applications-for-single-sign-on-vulnerabilities role=wild title=SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities
  RESIDUE CCS/2015/an-empirical-study-of-web-vulnerability-discovery-ecosystems role=cve title=An Empirical Study of Web Vulnerability Discovery Ecosystems.
  RESIDUE USENIX/2014/automatically-detecting-vulnerable-websites-before-they-turn-malicious role=offtopic title=Automatically Detecting Vulnerable Websites Before They Turn Malicious
  RESIDUE IMC/2016/a-view-from-the-other-side-understanding-mobile-phone-characteristics-in-the-dev role=offtopic title=A View from the Other Side: Understanding Mobile Phone Characteristics in the Developing World.
  RESIDUE IMC/2016/browser-feature-usage-on-the-modern-web role=cve title=Browser Feature Usage on the Modern Web.
  RESIDUE CCS/2017/a-large-scale-empirical-study-of-security-patches role=cve title=A Large-Scale Empirical Study of Security Patches.
  RESIDUE CCS/2017/rewriting-history-changing-the-archived-web-from-the-present role=wild title=Rewriting History: Changing the Archived Web from the Present.
  RESIDUE IMC/2017/measuring-and-mitigating-oauth-access-token-abuse-by-collusion-networks role=offtopic title=Measuring and mitigating oauth access token abuse by collusion networks.
  RESIDUE NDSS/2017/thou-shalt-not-depend-on-me-analysing-the-use-of-outdated-javascript-libraries-o role=cve title=Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web
  RESIDUE USENIX/2018/acquisitional-rule-based-engine-for-discovering-internet-of-things-devices role=offtopic title=Acquisitional Rule-based Engine for Discovering Internet-of-Things Devices
  RESIDUE USENIX/2018/from-patching-delays-to-infection-symptoms-using-risk-profiles-for-an-early-disc role=cve title=From Patching Delays to Infection Symptoms: Using Risk Profiles for an Early Discovery of Vulnerabilities Exploited in the Wild
  RESIDUE USENIX/2018/understanding-the-reproducibility-of-crowd-reported-security-vulnerabilities role=offtopic title=Understanding the Reproducibility of Crowd-reported Security Vulnerabilities
  RESIDUE USENIX/2019/devils-in-the-guidance-predicting-logic-vulnerabilities-in-payment-syndication-s role=lab title=Devils in the Guidance: Predicting Logic Vulnerabilities in Payment Syndication Services through Automated Documentation Analysis
  RESIDUE USENIX/2019/less-is-more-quantifying-the-security-benefits-of-debloating-web-applications role=lab title=Less is More: Quantifying the Security Benefits of Debloating Web Applications
  RESIDUE WWW/2019/an-investigation-of-cyber-autonomy-on-government-websites role=offtopic title=An Investigation of Cyber Autonomy on Government Websites.
  RESIDUE USENIX/2020/firmscope-automatic-uncovering-of-privilege-escalation-vulnerabilities-in-pre-in role=offtopic title=FIRMSCOPE: Automatic Uncovering of Privilege-Escalation Vulnerabilities in Pre-Installed Apps in Android Firmware
  RESIDUE CCS/2021/spinner-automated-dynamic-command-subsystem-perturbation role=lab title=Spinner: Automated Dynamic Command Subsystem Perturbation.
  RESIDUE USENIX/2021/blind-in-on-path-attacks-and-applications-to-vpns role=offtopic title=Blind In/On-Path Attacks and Applications to VPNs
  RESIDUE USENIX/2021/messy-states-of-wiring-vulnerabilities-in-emerging-personal-payment-systems role=lab title=Messy States of Wiring: Vulnerabilities in Emerging Personal Payment Systems
  RESIDUE WWW/2021/an-empirical-study-of-real-world-webassembly-binaries-security-languages-use-cas role=offtopic title=An Empirical Study of Real-World WebAssembly Binaries: Security, Languages, Use Cases.
  RESIDUE WWW/2021/tls-1-3-in-practice-how-tls-1-3-contributes-to-the-internet role=offtopic title=TLS 1.3 in Practice: How TLS 1.3 Contributes to the Internet.
  RESIDUE CCS/2022/cart-ology-intercepting-targeted-advertising-via-ad-network-identity-entanglemen role=offtopic title=Cart-ology: Intercepting Targeted Advertising via Ad Network Identity Entanglement.
  RESIDUE CCS/2022/distinct-identity-theft-using-in-browser-communications-in-dual-window-single-si role=wild title=DISTINCT: Identity Theft using In-Browser Communications in Dual-Window Single Sign-On.
  RESIDUE IMC/2022/exploring-the-security-and-privacy-risks-of-chatbots-in-messaging-services role=offtopic title=Exploring the security and privacy risks of chatbots in messaging services.
  RESIDUE PETS/2022/how-not-to-handle-keys-timing-attacks-on-fido-authenticator-privacy role=offtopic title=How Not to Handle Keys: Timing Attacks on FIDO Authenticator Privacy
  RESIDUE USENIX/2022/phish-in-sheeps-clothing-exploring-the-authentication-pitfalls-of-browser-finger role=offtopic title=Phish in Sheep's Clothing: Exploring the Authentication Pitfalls of Browser Fingerprinting
  RESIDUE IMC/2023/a-longitudinal-study-of-vulnerable-client-side-resources-and-web-developers-upda role=cve title=A Longitudinal Study of Vulnerable Client-side Resources and Web Developers' Updating Behaviors.
  RESIDUE CCS/2023/jack-in-the-box-an-empirical-study-of-javascript-bundling-on-the-web-and-its-sec role=cve title=Jack-in-the-box: An Empirical Study of JavaScript Bundling on the Web and its Security Implications.
  RESIDUE USENIX/2023/a-large-scale-measurement-of-website-login-policies role=wild title=A Large-Scale Measurement of Website Login Policies
  RESIDUE PETS/2023/comparing-large-scale-privacy-and-security-notifications role=wild title=Comparing Large-Scale Privacy and Security Notifications
  RESIDUE WWW/2023/bad-apples-understanding-the-centralized-security-risks-in-decentralized-ecosyst role=offtopic title=Bad Apples: Understanding the Centralized Security Risks in Decentralized Ecosystems.
  RESIDUE USENIX/2023/animatedead-debloating-web-applications-using-concolic-execution role=lab title=AnimateDead: Debloating Web Applications Using Concolic Execution
  RESIDUE USENIX/2023/extending-a-hand-to-attackers-browser-privilege-escalation-attacks-via-extension role=wild title=Extending a Hand to Attackers: Browser Privilege Escalation Attacks via Extensions
  RESIDUE USENIX/2023/minimalist-semi-automated-debloating-of-php-web-applications-through-static-anal role=lab title=Minimalist: Semi-automated Debloating of PHP Web Applications through Static Analysis
  RESIDUE NDSS/2024/quack-hindering-deserialization-attacks-via-static-duck-typing role=lab title=QUACK: Hindering Deserialization Attacks via Static Duck Typing
  RESIDUE CCS/2024/a-first-look-at-security-and-privacy-risks-in-the-rapidapi-ecosystem role=offtopic title=A First Look at Security and Privacy Risks in the RapidAPI Ecosystem.
  RESIDUE PETS/2024/a-black-box-privacy-analysis-of-messaging-service-providers-chat-message-process role=offtopic title=A Black-Box Privacy Analysis of Messaging Service Providers' Chat Message Processing
  RESIDUE IEEE-SP/2024/mawseo-adversarial-wiki-search-poisoning-for-illicit-online-promotion role=offtopic title=MAWSEO: Adversarial Wiki Search Poisoning for Illicit Online Promotion.
  RESIDUE IMC/2024/analyzing-the-impact-of-copying-and-pasting-vulnerable-solidity-code-snippets-fr role=offtopic title=Analyzing the Impact of Copying-and-Pasting Vulnerable Solidity Code Snippets from Question-and-Answer Websites.
  RESIDUE USENIX/2024/smudged-fingerprints-characterizing-and-improving-the-performance-of-web-applica role=cve title=Smudged Fingerprints: Characterizing and Improving the Performance of Web Application Fingerprinting
  RESIDUE IEEE-SP/2010/a-symbolic-execution-framework-for-javascript role=lab title=A Symbolic Execution Framework for JavaScript.
  RESIDUE IEEE-SP/2016/seeking-nonsense-looking-for-trouble-efficient-promotional-infection-detection-t role=offtopic title=Seeking Nonsense, Looking for Trouble: Efficient Promotional-Infection Detection through Semantic Inconsistency Search.
  RESIDUE CCS/2025/bacscan-automatic-black-box-detection-of-broken-access-control-vulnerabilities-i role=lab title=BACScan: Automatic Black-Box Detection of Broken-Access-Control Vulnerabilities in Web Applications.
  RESIDUE CCS/2025/in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the role=wild title=In the DOM We Trust: Exploring the Hidden Dangers of Reading from the DOM on the Web.
  RESIDUE NDSS/2025/attributing-open-source-contributions-is-critical-but-difficult-a-systematic-analysis-of-github-practices-and-their-impact-on-software-supply-chain-security role=offtopic title=Attributing Open-Source Contributions is Critical but Difficult: A Systematic Analysis of GitHub Practices and Their Impact on Software Supply Chain Security
  RESIDUE WWW/2025/whats-in-phishers-a-longitudinal-study-of-security-configurations-in-phishing-we role=offtopic title=What's in Phishers: A Longitudinal Study of Security Configurations in Phishing Websites and Kits.
  RESIDUE NDSS/2026/transparent-taint-style-vulnerability-detection-in-generic-single-page-applications-through-automated-framework-abstraction role=lab title=TranSPArent: Taint-style Vulnerability Detection in Generic Single Page Applications through Automated Framework Abstraction
  RESIDUE PETS/2026/the-masks-we-think-we-wear-privacy-threats-of-browser-extension-wallets-in-the-w role=offtopic title=The Masks We (Think We) Wear: Privacy Threats of Browser-Extension Wallets in the Web3 Ecosystem
  RESIDUE USENIX/2026/abuse-risks-are-often-inherent-to-product-features-exploring-ai-vendors-bug-boun role=offtopic title="Abuse Risks are Often Inherent to Product Features": Exploring AI Vendors' Bug Bounty and Responsible Disclosure Policies
  RESIDUE NDSS/2025/mens-sana-in-corpore-sano-sound-firmware-corpora-for-vulnerability-research role=offtopic title=Mens Sana In Corpore Sano: Sound Firmware Corpora for Vulnerability Research
  RESIDUE NDSS/2025/the-midas-touch-triggering-the-capability-of-llms-for-rm-api-misuse-detection role=offtopic title=The Midas Touch: Triggering the Capability of LLMs for RM-API Misuse Detection
  RESIDUE IEEE-SP/2012/lastor-a-low-latency-as-aware-tor-client role=offtopic title=LASTor: A Low-Latency AS-Aware Tor Client.
  RESIDUE NDSS/2025/misdirection-of-trust-demystifying-the-abuse-of-dedicated-url-shortening-service role=wild title=Misdirection of Trust: Demystifying the Abuse of Dedicated URL Shortening Service
  RESIDUE IEEE-SP/2012/evilseed-a-guided-approach-to-finding-malicious-web-pages role=offtopic title=EvilSeed: A Guided Approach to Finding Malicious Web Pages.
  RESIDUE IEEE-SP/2022/towards-automated-auditing-for-account-and-session-management-flaws-in-single-si role=wild title=Towards Automated Auditing for Account and Session Management Flaws in Single Sign-On Deployments.
  RESIDUE IEEE-SP/2023/devious-device-driven-side-channel-attacks-on-the-iommu role=offtopic title=DevIOus: Device-Driven Side-Channel Attacks on the IOMMU.
  RESIDUE IEEE-SP/2023/toss-a-fault-to-your-witcher-applying-grey-box-coverage-guided-mutational-fuzzin role=lab title=Toss a Fault to Your Witcher: Applying Grey-box Coverage-Guided Mutational Fuzzing to Detect SQL and Command Injection Vulnerabilities.
PUBLISHED_KIND_XSS 25
PUBLISHED_KIND_CSRF 7
PUBLISHED_KIND_CLICKJACK 1
PUBLISHED_KIND_SOP 4
PUBLISHED_KIND_RESIDUE 62
PUBLISHED_WILD_XSS 14
 
==========================================================================
E. YEAR BUCKETS
==========================================================================
 
── E1. conjunction of 99 ──
Window      Papers  Share of 99
----------  ------  -----------
2010–2013   11      11.1%
2014–2017   13      13.1%
2018–2021   18      18.2%
2022–2024   37      37.4%
2025–2026*  20      20.2%
 
── E2. wild role ──
Window      Wild papers  Share of 30
----------  -----------  -----------
2010–2013   3            10.0%
2014–2017   5            16.7%
2018–2021   4            13.3%
2022–2024   12           40.0%
2025–2026*  6            20.0%
 
── E3. per-year wild, corpus denominator, 2025–2026 starred ──
Year | Corpus | Wild | Share | Provisional
2010 | 119 | 1 | 0.8% | no
2011 | 116 | 0 | 0.0% | no
2012 | 151 | 0 | 0.0% | no
2013 | 125 | 2 | 1.6% | no
2014 | 166 | 2 | 1.2% | no
2015 | 190 | 1 | 0.5% | no
2016 | 182 | 0 | 0.0% | no
2017 | 231 | 2 | 0.9% | no
2018 | 254 | 0 | 0.0% | no
2019 | 402 | 2 | 0.5% | no
2020 | 404 | 1 | 0.2% | no
2021 | 379 | 1 | 0.3% | no
2022 | 546 | 5 | 0.9% | no
2023 | 719 | 4 | 0.6% | no
2024 | 690 | 3 | 0.4% | no
2025 | 770 | 5 | 0.6% | yes
2026 | 415 | 1 | 0.2% | yes
 
==========================================================================
F. VENUE
==========================================================================
Venue    Of 99  Wild
-------  -----  ----
USENIX   31     10
IEEE-SP  18     6
CCS      16     7
NDSS     15     6
WWW      9      0
IMC      6      0
PETS     4      1
 
==========================================================================
G. INTERACTION DEPTH (landing-page undercount)
==========================================================================
 
── G1. all 99 ──
interactionDepth       Papers  Share of 99 conjunction
---------------------  ------  -----------------------
landing-page-only      8       8.1%
single-target-page     23      23.2%
landing-plus-subpages  14      14.1%
deep-crawl             31      31.3%
not-stated             19      19.2%
no-crawlConfig         4       4.0%
 
── G2. wild only ──
interactionDepth       Papers  Share of 30 wild
---------------------  ------  ----------------
landing-page-only      2       6.7%
single-target-page     5       16.7%
landing-plus-subpages  9       30.0%
deep-crawl             10      33.3%
not-stated             2       6.7%
no-crawlConfig         2       6.7%
PUBLISHED_WILD_LANDING 2
PUBLISHED_WILD_SINGLE 5
PUBLISHED_WILD_DEEP 10
PUBLISHED_WILD_DEPTH_NOT_STATED 2
PUBLISHED_WILD_SUBPAGES_STATED 10
shallow (landing-page-only + single-target-page) among wild: 7 / 30 = 23.3%
PUBLISHED_WILD_ARCHIVE_SURFACE 2
PUBLISHED_WILD_THEN_LIVE 28
  archive-surface CCS/2017/rewriting-history-changing-the-archived-web-from-the-present Rewriting History: Changing the Archived Web from the Present.
  archive-surface USENIX/2017/how-the-web-tangled-itself-uncovering-the-history-of-client-side-web-in-security How the Web Tangled Itself: Uncovering the History of Client-Side Web (In)Security
 
==========================================================================
H. CLASSIFICATION METHOD (vuln tuples, sentinels skipped)
==========================================================================
 
── H1. conjunction of 99 ──
method               Papers of 99  Share
-------------------  ------------  -----
heuristic-rules      33            33.3%
manual-labelling     28            28.3%
dynamic-analysis     19            19.2%
static-analysis      13            13.1%
curated-database     12            12.1%
supervised-ml        6             6.1%
regex-or-signature   6             6.1%
third-party-service  3             3.0%
graph-analysis       2             2.0%
other                1             1.0%
blocklist            1             1.0%
 
── H2. wild only (the wild-role method distribution; includes the 2 archive-surface papers) ──
method              Papers of 30 wild  Share
------------------  -----------------  -----
dynamic-analysis    14                 46.7%
heuristic-rules     12                 40.0%
manual-labelling    8                  26.7%
static-analysis     4                  13.3%
graph-analysis      2                  6.7%
supervised-ml       1                  3.3%
regex-or-signature  1                  3.3%
 
==========================================================================
I. FULL-TEXT PROBES (upper bounds; missing .cols counted as negatives)
==========================================================================
xss: corpus 409 (miss 4) | web+crawled 158 (miss 0) | wild 25 of 30
csrf: corpus 182 (miss 4) | web+crawled 81 (miss 0) | wild 14 of 30
clickjack: corpus 95 (miss 4) | web+crawled 39 (miss 0) | wild 7 of 30
sop: corpus 195 (miss 4) | web+crawled 101 (miss 0) | wild 12 of 30
domxss: corpus 77 (miss 4) | web+crawled 50 (miss 0) | wild 14 of 30
stored-xss: corpus 50 (miss 4) | web+crawled 25 (miss 0) | wild 5 of 30
reflected-xss: corpus 41 (miss 4) | web+crawled 22 (miss 0) | wild 5 of 30
scanner-classic: corpus 24 (miss 4) | web+crawled 12 (miss 0) | wild 0 of 30
scanner-plus: corpus 81 (miss 4) | web+crawled 37 (miss 0) | wild 7 of 30
false-positive: corpus 2574 (miss 4) | web+crawled 493 (miss 0) | wild 25 of 30
manually-confirm: corpus 1279 (miss 4) | web+crawled 319 (miss 0) | wild 20 of 30
PUBLISHED_SCANNER_FT 24
PUBLISHED_CLICKJACK_WEBCRAWL_FT 39
clickjacking full-text among web+crawled is an UPPER BOUND, not a population.
 
==========================================================================
J. POSTERS in the 99
==========================================================================
posters in the 99: 1
  CCS/2024/poster-security-of-login-interfaces-in-modern-organizations role=wild title=Poster: Security of Login Interfaces in Modern Organizations.
PUBLISHED_POSTERS 1
 
==========================================================================
K. ROLE QUOTE CHECK against paper.cols.txt
==========================================================================
ROLE quotes: exact 68 / partial(>=60% 5-word windows) 31 / below 0 / of 99
PUBLISHED_QUOTE_EXACT 68
PUBLISHED_QUOTE_PARTIAL 31
PUBLISHED_QUOTE_BELOW 0
 
==========================================================================
L. PER-PAPER DETECTION FIGURES (wild XSS and named cover papers)
==========================================================================
--- CCS/2013/25-million-flows-later-large-scale-detection-of-dom-based-xss role=wild in99=true
  phen="DOM-based XSS vulnerabilities"
  metric="unique vulnerabilities and affected domains"
  prev="6,167 unique vulnerabilities on 480 domains; 9.6% of the top 5000 sites"
  phen="Potentially unsafe data flows"
  metric="number of captured flows"
  prev="24,474,306 data flows"
  phen="Exploitable DOM-based XSS flows"
  metric="validated exploit success rate"
  prev="69,987 of 181,238 generated payloads successfully executed injected JavaScript"
  phen="Chromium XSS Filter bypasses"
  metric="susceptible domains"
  prev="300 of 701 domains remained susceptible"
--- NDSS/2019/dont-trust-the-locals-investigating-the-prevalence-of-persistent-client-side-cross-site-scripting-in-the-wild role=wild in99=true
  phen="persistent client-side XSS"
  metric="share of Alexa Top 5,000 domains"
  prev="more than 8% exhibit exploitable flows from client-side storage to a dangerous sink"
  phen="persistent client-side XSS"
  metric="share among domains using persisted data in sinks"
  prev="21% of sites are vulnerable"
  phen="persistent client-side XSS"
  metric="number of exploitable domains"
  prev="418 of 1,324 domains"
  phen="Network Attacker exploitability"
  metric="share of theoretically exploitable domains"
  prev="293 of 418 domains"
  phen="Web Attacker exploitability"
  metric="number of exploitable domains"
  prev="65 of 418 domains"
  phen="reflected client-side XSS"
  metric="number of susceptible domains"
  prev="468 of the top 5,000 domains"
--- IEEE-SP/2010/state-of-the-art-automated-black-box-web-application-vulnerability-testing role=lab in99=true
  phen="scanner vulnerability detection"
  metric="detection rate"
  prev="Reflected XSS exceeded 60% average detection; second-order SQL injection was detected by no scanner."
  phen="link traversal coverage"
  metric="percentage of successful links crawled"
  prev="Coverage was low for Java applets, SilverLight, and Flash."
  phen="scanner network footprint"
  metric="network bytes sent and received"
  prev="Traffic ranged from 80 MB to nearly 1 GB."
  phen="scanner execution time"
  metric="elapsed scanning time"
  prev="Execution time ranged from 66 to 473 minutes."
  phen="false positives"
  metric="false-positive count"
  prev="Two scanners reported false positives for the benign script region."
  phen="stored XSS detection"
  metric="detection rate"
  prev="Stored XSS detection was 15%."
  phen="second-order SQL injection detection"
  metric="detection rate"
  prev="No scanner detected even one second-order SQL injection vulnerability."
--- IEEE-SP/2021/black-widow-blackbox-data-driven-web-scanning role=lab in99=true
  phen="server-side code coverage"
  metric="number of unique executed lines"
  prev="Black Widow had the highest coverage on 9 out of 10 applications"
  phen="reflected and stored XSS"
  metric="unique correctly executing XSS injections"
  prev="25 unique vulnerabilities, including 6 previously unknown"
  phen="false-positive XSS reports"
  metric="false-positive count"
  prev="No false positives reported by Black Widow on tested applications"
--- IEEE-SP/2022/the-state-of-the-samesite-studying-the-usage-effectiveness-and-adequacy-of-sames role=wild in99=true
  phen="SameSite cookie adoption"
  metric="share of sites using each policy"
  prev="18.94% of sites adopted one of the three valid policies by March 2021"
  phen="Cross-site functionality breakage"
  metric="share of sampled requests broken"
  prev="19% of affected cross-site requests were broken; 77.5% involved advertising networks"
  phen="State-changing GET CSRF"
  metric="vulnerable sampled requests"
  prev="7 of 264 GET requests were forgeable, affecting four websites"
  phen="Window-properties and postMessage XS-Leaks"
  metric="vulnerable URLs and websites"
  prev="1,302 vulnerable URLs across 40 distinct websites"
  phen="SameSite bypass via POST-to-GET"
  metric="vulnerable sampled POST requests"
  prev="9 of 602 requests were forgeable, affecting six websites"
  phen="SSO redirect bypass"
  metric="affected websites"
  prev="Six IdPs enabled bypass across 4,935 sites, over 49% of Alexa top 10K"
  phen="User-agent SameSite inconsistency"
  metric="vulnerable websites"
  prev="9,951 websites allowed a policy downgrade in April 2021"
  phen="Browser and framework divergence"
  metric="distinct browser behaviors and framework share"
  prev="Seven browser behaviors; 24% of frameworks set None by default"
--- IEEE-SP/2025/403-forbidden-ethically-evaluating-broken-access-control-in-the-wild role=wild in99=true
  phen="AC-sensitive HTTP endpoints"
  metric="unique probing URL templates"
  prev="584 unique URL templates"
  phen="Improper access control"
  metric="share of tested sites with improper responses"
  prev="30 endpoints across 15 of 100 sites"
  phen="Broken access-control vulnerabilities"
  metric="confirmed vulnerabilities"
  prev="19 vulnerabilities across 7 sites"
--- NDSS/2013/the-postman-always-rings-twice-attacking-and-defending-postmessage-in-html5-webs role=wild in99=true
  phen="postMessage receiver usage"
  metric="share of visited hosts"
  prev="2,245 hosts (22% of the visited hosts)"
  phen="missing origin checks"
  metric="distinct receivers and hosts"
  prev="65 receivers used by 1,585 hosts"
  phen="incorrect origin checks"
  metric="distinct receivers and hosts"
  prev="14 receivers used by 261 hosts"
  phen="missing or incorrect origin checks"
  metric="affected hosts"
  prev="1,712 hosts"
  phen="exploitable postMessage vulnerabilities"
  metric="distinct receivers and hosts"
  prev="13 receivers compromising 84 hosts"
  phen="incorrect-origin-check bypass domains"
  metric="existing domains passing checks"
  prev="Examples include 2,291 and 2,276 existing domains"
--- USENIX/2017/how-the-web-tangled-itself-uncovering-the-history-of-client-side-web-in-security role=wild in99=true
  phen="client-side XSS"
  metric="share of domains with a verified exploitable flaw"
  prev="about 8% of the 2016 sites exploitable"
  phen="insecure postMessage receivers"
  metric="share of receiving domains without origin checks"
  prev="48.0% in 2016"
  phen="wildcard postMessage targets"
  metric="share of domains sending wildcard-target messages"
  prev="50.3% in 2016"
  phen="dangerous Flash crossdomain policies"
  metric="share of domains"
  prev="about 7% had dangerous wildcards in 2008; at most 3% appeared vulnerable"
  phen="outdated vulnerable JavaScript libraries"
  metric="share of domains using vulnerable versions"
  prev="85% of sites running YUI used a vulnerable version in 2016"
  phen="security-header adoption"
  metric="share of domains deploying CSP"
  prev="less than 10% in 2016"
  phen="remote script inclusions"
  metric="average distinct remote origins per domain"
  prev="almost 12 distinct remote origins per domain in 2016"
  phen="JSONP usage"
  metric="share of sites using JSONP"
  prev="at most about 17% of all sites"
--- NDSS/2022/auto-draft-207 role=wild in99=true
  phen="client-side prototype pollution"
  metric="number of exploitable vulnerabilities and domains"
  prev="2,738 domains with 2,917 exploitable prototype pollution vulnerabilities among one million websites"
  phen="XSS consequences"
  metric="number of vulnerabilities"
  prev="48 vulnerabilities"
  phen="cookie manipulation"
  metric="number of vulnerabilities"
  prev="736 vulnerabilities"
  phen="URL manipulation"
  metric="number of vulnerabilities"
  prev="830 vulnerabilities"
  phen="real-world prototype-pollution defenses"
  metric="joint flows and domains by defense type"
  prev="Object sanitization: 22,235 joint flows across 1,489 domains"
--- IEEE-SP/2023/its-dom-clobbering-time-attack-techniques-prevalence-and-defenses role=wild in99=true
  phen="DOM-clobbering markups"
  metric="number of distinct markups working in at least one browser"
  prev="31,432 distinct DOM Clobbering markups"
  phen="Browser-specific clobbering behavior"
  metric="behavioral groups"
  prev="10 distinct groups of browser behaviours"
  phen="Native API clobbering"
  metric="APIs clobbered in at least one browser"
  prev="347 DOM APIs, including 114 window APIs"
  phen="DOM-clobbering vulnerabilities"
  metric="confirmed data flows and affected websites"
  prev="9,467 flows across 491 sites"
  phen="Website vulnerability prevalence"
  metric="share of tested websites"
  prev="9.8% (491 of 5,000)"
  phen="Exploitability"
  metric="websites with proof-of-concept exploits"
  prev="44 websites"
  phen="HTML sanitizer robustness"
  metric="sanitizers vulnerable by default"
  prev="16 of 29 sanitizers"
  phen="CSP mitigation coverage"
  metric="XSS vulnerabilities mitigated by CSP"
  prev="1,385 of 3,677 XSS vulnerabilities (37.7%)"
--- IEEE-SP/2024/the-great-request-robbery-an-empirical-study-of-client-side-request-hijacking-vu role=wild in99=true
  phen="client-side request hijacking data flows"
  metric="verified vulnerable data flows, affected webpages and sites"
  prev="202,834 verified flows affecting 17,805 webpages and 961 sites; 9.6% of the top 10K sites"
  phen="request-sending API usage"
  metric="API calls, webpages and domains"
  prev="Approximately 7.9M API calls across 1,032,795 webpages and 9,901 domains"
  phen="request hijacking exploitability"
  metric="proof-of-concept exploits and affected websites"
  prev="67 proof-of-concept exploits across 49 websites"
  phen="defense adoption and coverage"
  metric="pages and sites adopting defenses; mitigated flow share"
  prev="CSP mitigated information leakage and XSS in 58.7% of flows; 7.6% of webpages deployed the relevant CSP directive"
--- USENIX/2024/dancer-in-the-dark-synthesizing-and-evaluating-polyglots-for-blind-cross-site-sc role=wild in99=true
  phen="XSS polyglot coverage"
  metric="number of injection contexts solved"
  prev="Seven polyglots covered all 111 selected GFR test cases."
  phen="client-side XSS"
  metric="validated vulnerabilities"
  prev="147 vulnerabilities triggered by synthesized polyglots versus 145 by precise payload generation."
  phen="blind XSS"
  metric="vulnerabilities and affected websites"
  prev="20 vulnerabilities on 18 websites."
  phen="blind XSS"
  metric="share of backends by submission type"
  prev="Headers triggered 10 vulnerabilities, URLs 9, and forms 1."
  phen="crawler page failures"
  metric="share of visited pages failing"
  prev="Approximately 7.4% of 1,676,812 visited pages failed to load."
--- CCS/2025/in-the-dom-we-trust-exploring-the-hidden-dangers-of-reading-from-the-dom-on-the role=wild in99=true
  phen="DOM-to-sink data flows"
  metric="verified flow count and affected sites"
  prev="357,982 verified gadgets across 14,345 webpages and 2,259 sites"
  phen="Markup injection vulnerabilities"
  metric="verified dataflow count"
  prev="4,722 verified dataflows across 34,223 webpages"
  phen="DOM-gadget exploitability"
  metric="end-to-end verified flows and sites"
  prev="657 flows across 37 sites"
  phen="Missing sanitization or validation"
  metric="share of static flows without relevant patterns"
  prev="10.38% contained no sanitization or validation patterns"
  phen="DOM selector complexity"
  metric="mean and median complexity"
  prev="average 1.80 and median 2"
  phen="Element-order exploitation requirement"
  metric="share requiring reordering techniques"
  prev="34% of 253K combinations had injected markup after the selected element"
  phen="Detection false negatives"
  metric="false negative rate"
  prev="38.5%"
--- NDSS/2025/do-not-follow-the-white-rabbit-challenging-the-myth-of-harmless-open-redirection role=wild in99=true
  phen="open redirect vulnerabilities"
  metric="number of confirmed vulnerabilities and affected websites"
  prev="20,898 confirmed open redirections across 623 websites"
  phen="open redirect prevalence"
  metric="share of top-10K websites"
  prev="approximately 8.7% of the top 10K websites"
  phen="archived open redirects"
  metric="confirmed vulnerabilities and affected websites"
  prev="375 vulnerabilities across 326 websites"
  phen="DOM-based XSS escalation"
  metric="share of vulnerabilities and affected sites"
  prev="about 9% of vulnerabilities across 33.2% of affected sites"
  phen="client-side CSRF escalation"
  metric="number and share of open redirects"
  prev="42 vulnerabilities, over 2.4% of open redirects"
  phen="information leakage escalation"
  metric="number and share of open redirects"
  prev="3 vulnerabilities, about 0.2% of open redirects"
  phen="redirect mitigations"
  metric="share of audited sites"
  prev="six mitigation types; redirect notices used by 54.4%"
  phen="indicator false negatives"
  metric="false-negative rate"
  prev="76% for indicators compared with static analysis"
--- NDSS/2026/dom-xss-detection-via-webpage-interaction-fuzzing-and-url-component-synthesis role=wild in99=true
  phen="DOM-XSS vulnerabilities"
  metric="unique confirmed vulnerable flows and pages"
  prev="114 unique DOM-XSS vulnerable flows in 146 pages"
  phen="Interaction-triggered DOM-XSS"
  metric="confirmed-flow increase over passive analysis"
  prev="15% more confirmed flows than Passive"
  phen="URL-parameter and fragment-triggered DOM-XSS"
  metric="new confirmed vulnerabilities"
  prev="20 new vulnerabilities"
  phen="Synthesized GET parameters"
  metric="overlap with ffuf/wfuzz wordlists"
  prev="95.6% of DSE-synthesized keys absent from those wordlists"
--- USENIX/2020/cached-and-confused-web-cache-deception-in-the-wild role=wild in99=true
  phen="web cache deception"
  metric="share of sites"
  prev="16 of 295 sites (5.4%)"
  phen="web cache deception variants"
  metric="share of sites"
  prev="25 of 340 sites; encoded techniques exploited 23 of 25 sites"
  phen="private-information leakage"
  metric="share of vulnerable sites"
  prev="14 of 16 vulnerable sites leaked PII"
  phen="security-token leakage"
  metric="share of vulnerable sites"
  prev="6 of 16 sites leaked CSRF tokens; 6 leaked session identifiers or API tokens"
  phen="unauthenticated exploitation"
  metric="share of vulnerable sites"
  prev="All remaining vulnerabilities were manually found exploitable without authentication"
  phen="cache expiration"
  metric="number of exploitable sites after delay"
  prev="16 sites after 1 hour, 10 after 6 hours, and 9 after 1 day"
  phen="CDN caching behavior"
  metric="default caching behavior and honored headers"
  prev="Akamai, Cloudflare, CloudFront, and Fastly showed distinct defaults"
--- CCS/2015/from-facepalm-to-brain-bender-exploring-client-side-cross-site-scripting role=wild in99=true
  phen="client-side XSS vulnerabilities"
  metric="count of exploitable flows"
  prev="1,273 actual vulnerabilities from 1,146 URLs"
  phen="vulnerability complexity"
  metric="low/medium/high complexity classification"
  prev="63.9% low, 20.5% medium, and 15.6% high combined complexity"
  phen="non-linear data and control flows"
  metric="count of vulnerable flows"
  prev="98 non-linear data flows; 59 flows with both non-linear data and control flow"
  phen="third-party code involvement"
  metric="count of vulnerabilities"
  prev="273 exclusively third-party; 165 mixed self-hosted and third-party"
  phen="multiflows"
  metric="count of exploited Web pages"
  prev="344 multiflow vulnerabilities"
  phen="vulnerable sink types"
  metric="count of exploitable flows"
  prev="732 document.write, 495 innerHTML, and 46 eval or derivatives"
  phen="cross-browser exploitability"
  metric="URLs triggering payload"
  prev="109 URLs still triggered the payload in Firefox"
 
==========================================================================
M. STUDY TYPES among wild
==========================================================================
studyType                   Wild papers  Share of 30
--------------------------  -----------  -----------
automated-web-crawl         30           100.0%
manual-audit                23           76.7%
system-or-defence-proposal  23           76.7%
code-or-binary-analysis     16           53.3%
existing-dataset-analysis   12           40.0%
network-scan-or-probe       4            13.3%
user-study                  1            3.3%
interview-or-survey         1            3.3%
mobile-app-analysis         1            3.3%
 
==========================================================================
Y. ARITHMETIC
==========================================================================
880 used / 5859 = 15.0%
209 web / 880 = 23.8%
99 web+crawled / 880 = 11.3%
99 / 1120 crawled = 8.8%
30 wild / 99 = 30.3%
30 wild / 1120 crawled = 2.7%
27 lab / 99 = 27.3%
8 cve / 99 = 8.1%
34 offtopic / 99 = 34.3%
433 offline-multi / 880 = 49.2%
260 offline-only / 880 = 29.5%
kind xss 25/99 = 25.3%
wild xss 14/30 wild = 46.7%
clickjack kind in 99: 1
csrf kind in 99: 7
sop kind in 99: 4
 
==========================================================================
Z. NON-CORPUS FIGURES (primary sources; re-fetched by external_checks_web_vuln.sh)
==========================================================================
Chrome XSS Auditor removed: Chrome 78, 2019-10. Chromium bug 709804 / release blog.
Chrome SameSite Lax-by-default: Chrome 80, 2020-02. Chromium SameSite updates.
OWASP Top 10 2021: A03 Injection; XSS folded into Injection. owasp.org/Top10/2021/.
OWASP Top 10:2025: do not cite a 2017 XSS-as-A7 ranking as current.
OWASP ZAP is now ZAP by Checkmarx (rebrand 2024-09-24); zaproxy.org.
Nuclei is projectdiscovery/nuclei; templates in nuclei-templates. Too thin in this corpus to carry a page.
count_vuln_sites.py --demo: 5 rows, 5 URLs, 3 hosts, 3 confirmed rows, 3 confirmed URLs, 2 confirmed hosts
Lekies et al. CCS 2013: 6,167 unique vulnerabilities on 480 domains; 9.6% of Alexa top 5000; 24,474,306 flows; 69,987 of 181,238 payloads executed
Steffens et al. NDSS 2019: Alexa Top 5,000; more than 8% unfiltered storage-to-sink flows; 21% of sites that use stored data; 418 of 1,324 exploitable; 468 of 5,000 reflected Client-Side XSS
Bau et al. IEEE S&P 2010: reflected XSS detection over 60%; stored XSS 15%; second-order SQLi detected by no scanner
Chehade, Hantke and Stock, IEEE S&P 2025: 100 sites; 30 improper endpoints on 15 sites; 19 confirmed vulns across 7 sites
programming:interaction: 155 of 417 (37.2%) landing-page-only on the site-depth axis; 857 crawled-web papers. Quoted, not re-derived.
Foxhound lineage: programming:crawler:foxhound. Taint tracking is the current client-side XSS instrument in this corpus.
Hantke et al. Red Lines: practices:ethics. Notification: practices:notifying_websites.
Corpus posters: 138 of 5,859 (literature:corpus). One poster is in this 99.
ZAP rebrand 2024-09-24: ZAP by Checkmarx, Apache v2; zaproxy.org/blog/2024-09-24-zap-has-joined-forces-with-checkmarx/
Chrome SameSite Lax-by-default: Chrome 80, 2020-02
OWASP Top 10:2025 A01 Broken Access Control; A05 Injection includes XSS as CWE-79; XSS is not a standalone Top-10 letter
OWASP Top 10 2017 had XSS as A7; 2021 folded XSS into A03 Injection; 2025 is A05
review tokens: FIG-01 FIG-02 CIT-01 CUR-01 GENERIC_PLACEHOLDER_FORBIDDEN