What are XS-Leaks (Cross-Site Leaks) and how do they work?

Side-channel attacks: even without reading another site's data directly, an attacker measures observable side effects (load timing, onload/onerror, cache hits, frame counts) to infer cross-origin information like "is this user logged in?"

XS-Leaks exploit browser side channels to leak information across origins.

How it works:

• Web content often combines resources from multiple sources (e.g., YouTube embed on Facebook)
• Rendering external content creates observable timing differences
• Attackers measure these timing differences to infer information

Side channel examples:

• Load timing: Measure how long resources take to load
• onload/onerror events: Detect if resource exists
• Cache timing: Determine if resource was cached (previously visited)
• Frame counting: Count iframes in a page

Impact: Can detect login status, infer user data, determine if user has specific content.

See: XS-Leaks Wiki — comprehensive catalog of cross-site leak techniques