Data Exfiltration over Browser

Since data can be highly valuable across a wide range of contexts (e.g., government, education, and banking), it is an attractive target for adversaries, including criminals, governments, and even law enforcement agencies. With modern web technologies, even nontechnical users equipped with readily accessible tools can perform attacks to exfiltrate sensitive data, making detection and prevention increasingly challenging. In this work, we demonstrate a browser-based data exfiltration threat, referred to as DEoB, that leverages the File System Access (FSA) and Fetch APIs, two web standards implemented in Chromium-based browsers (e.g., Chrome, Edge, Opera) but notably absent in others. DEoB operates entirely through victims’ browsers and does not require malicious binaries. We evaluate DEoB across five cloud providers, four commercial antivirus solutions, 51 file formats, and three operating systems. Our results show that DEoB bypasses these antivirus solutions and can exfiltrate a wide range of file types from external storage, network-shared folders, and both local and cloud-integrated directories. To explore countermeasures, we conduct a user study involving 200 Chrome users from a large academic environment. Based on the findings, we design an improved permission dialog interface and develop a browser extension, DEoBProtector, which alerts users whenever the FSA or Fetch APIs are accessed, providing temporary protection against DEoB-style threats. Our proposed redesign of the FSA permission dialog was later accepted by Chromium, and the corresponding wording update landed in July 2025.