PhD Position F/M Detecting Dangerous Browser Extensions to Protect the Security and Privacy of Web Users

Contenu principal

Accessibilité

Contact

Mentions légales

Menu

Fermer

FR EN

Se connecter

Offres d'emploi Inria >

Offre n°2026-10612

PhD Position F/M Detecting Dangerous Browser Extensions to Protect the Security and Privacy of Web Users

Télécharger l'offre au format PDF

Le descriptif de l’offre ci-dessous est en Anglais

Type de contrat : CDD

Niveau de diplôme exigé : Bac + 5 ou équivalent

Fonction : Doctorant

A propos du centre ou de la direction fonctionnelle

Inria is the French National Institute for Research in Digital Science, of which the Inria Côte d'Azur University Center is a part. With strong expertise in computer science and applied mathematics, the research projects of the Inria Côte d'Azur University Center cover all aspects of digital science and technology and generate innovation. Based mainly in Sophia Antipolis, but also in Nice and Montpellier, it brings together 47 research teams and nine support services. It is active in the fields of artificial intelligence, data science, IT system security, robotics, network engineering, natural risk prevention, ecological transition, digital biology, computational neuroscience, health data, and more. The Inria Center at Université Côte d'Azur is a major player in terms of scientific excellence, thanks to the results it has achieved and its collaborations at both European and international level.

Contexte et atouts du poste

The PhD position is funded by the French National Research Agency (ANR). It is part of Aurore Fass' ANR JCJC project "EXPELLIARMUS: Disarming Dangerous Browser Extensions to Protect the Security and Privacy of Web Users".

EXPELLIARMUS, aims to develop methods to "disarm" dangerous extensions to better protect the security and privacy of Web users. More specifically, it will detect, understand, and mitigate dangerous browser extensions through an interdisciplinary approach combining computer science, human factors, and legal analysis. EXPELLIARMUS will deliver a systematic taxonomy of dangerous extension behaviors, open-source datasets and detection tools, as well as actionable recommendations for users, browser vendors, developers, and regulators.

The PhD student will be part of the research team led by Dr. Nataliia Bielova (https://www-sop.inria.fr/members/Nataliia.Bielova/index.html) at the Inria Centre at Université Côte d’Azur at the French Riviera. The PhD student will be supervised by Dr.-Ing. Aurore Fass (https://aurore54f.github.io/). Note that a PhD in France typically lasts 3 years.

Mission confiée

Context on Browser Extension Security

Given the central role of the Web in our daily lives and its overall impact on society and economy, it is crucial that Web pages and browser extensions assure the security and privacy of their large user base.

Browser extensions have become an integral part of the modern Web ecosystem. The most popular desktop browser Chrome lists 280k browser extensions [1] (totaling almost 3 billion active users) in its official gallery, the Chrome Web Store [2]. Browser extensions enable users to enhance and customize their browsing experience: typically, extensions offer additional functionality to Web users, such as ad blocking (e.g., AdBlock), grammar checks (e.g., Grammarly), or password management (e.g., LastPass). To operate, browser extensions need elevated privileges compared to Web pages. Browser extensions can access sensitive user data, such as cookies or browsing history, and they can interact with arbitrary websites and other extensions [3, 4, 5]. While a compromised or malicious Web page is in itself troublesome, a malicious or vulnerable browser extension is much more powerful, as an attacker can leverage an extension's elevated privileges to cause more harm [3]. In particular, browser extensions can exfiltrate sensitive user data [6], track users online [7], or propagate unwanted software [8]. Detecting such threats at scale remains a challenge, as the extension ecosystem is particularly large, diverse, and continuously evolving.

Limitations of existing work Abundant prior work attempted to detect some classes of dangerous extensions [9], e.g., malicious [10], vulnerable [3], or fingerprintable extensions [11]. However, related works have major limitations. Existing works analyze only hundreds of extensions [12], are outdated (e.g., 2012–2015 [8, 13, 14, 15]), have limited scalability and necessitate significant manual effort [16, 4], lack a clear characterization of what a dangerous behavior is [14]; and finally, only a small minority thereof is open source, as we have highlighted in [10]. Besides, existing machine learning-based detectors are opaque, they lack interpretability and explainability.

It is therefore critical to design automated, large-scale, and reliable security and privacy analyses of browser extensions that have the potential to be deployed in the real world.

References:

[1] chrome-stats. Chrome extension statistics. https://chrome-stats.com/chrome/stats

[2] Google. Chrome Web Store. https://chromewebstore.google.com

[3] Aurore Fass, Dolière Francis Somé, Michael Backes, and Ben Stock. DoubleX: Statically Detecting Vulnerable Data Flows in Browser Extensions at Scale. In ACM CCS, 2021. Code repository: https://github.com/Aurore54F/DoubleX

[4] Dolière Francis Somé. Empoweb: Empowering web applications with browser extensions. In IEEE S&P, 2019.

[5] Jianjia Yu, Song Li, Junmin Zhu, and Yinzhi Cao. Coco: Efficient browser extension vulnerability detection via coverage-guided, con- current abstract interpretation. In ACM CCS, 2023.

[6] Quan Chen and Alexandros Kapravelos. Mystique: Uncovering information leakage from browser extensions. In ACM CCS, 2018.

[7] Michael Weissbacher, Enrico Mariconti, Guillermo Suarez-Tangil, Gianluca Stringhini, William Robertson, and Engin Kirda. Ex-ray: Detection of history-leaking browser extensions. In ACSAC, 2017.

[8] Xinyu Xing, Wei Meng, Byoungyoung Lee, Udi Weinsberg, Anmol Sheth, Roberto Perdisci, and Wenke Lee. Understanding malvertising through ad-injecting browser extensions. In TheWebConf, 2015.

[9] Sheryl Hsu, Manda Tran, and Aurore Fass. What is in the Chrome Web Store? Investigating Security-Noteworthy Browser Extensions. In ACM AsiaCCS, 2024.

[10] Ben Rosenzweig, Valentino Dalla Valle, Giovanni Apruzzese, and Aurore Fass. It's not easy: Applying supervised machine learning to detect malicious extensions in the chrome web store. In ACM Transactions on the Web (TWEB), 2026. Code repository: https://github.com/its-not-easy/tweb25/tree/main

[11] Shubham Agarwal, Aurore Fass, and Ben Stock. Peeking through the window: Fingerprinting browser extensions through page-visible execution traces and interactions. In ACM CCS, 2024. Code repository: https://github.com/raider-ext/raider

[12] Nicholas Carlini, Adrienne Porter Felt, and David Wagner. An evaluation of the google chrome extension security architecture. In USENIX Security, 2012.

[13] Nav Jagpal, Eric Dingle, Jean-Philippe Gravel, Panayiotis Mavrommatis, Niels Provos, Moheeb Abu Rajab, and Kurt Thomas. Trends and lessons from three years fighting malicious extensions. In USENIX Security, 2015.

[14] Alexandros Kapravelos, Chris Grier, Neha Chachra, Christopher Kruegel, Giovanni Vigna, and Vern Paxson. Hulk: Eliciting malicious behavior in browser extensions. In USENIX Security, 2014.

[15] Kurt Thomas, Elie Bursztein, Chris Grier, Grant Ho, Nav Jagpal, Alexandros Kapravelos, Damon Mccoy, Antonio Nappa, Vern Paxson, Paul Pearce, Niels Provos, and Moheeb Abu Rajab. Ad injection at scale: Assessing deceptive advertisement modifications. In IEEE S&P, 2015.

[16] Nikolaos Pantelaios, Nick Nikiforakis, and Alexandros Kapravelos. You’ve changed: Detecting malicious browser extensions through their update deltas. In ACM CCS, 2020.

Principales activités

Objectives of the PhD

The broad objective of this PhD is to develop new automated tools to detect dangerous browser extensions, with a specific focus on malicious extensions. While the majority of prior work focuses on Chrome, we also want to study dangerous extensions on other browsers, such as Firefox and Edge, since we showed that the same malicious extensions can be published on multiple galleries [1].

• Objective 1: Generate a large-scale dataset of browser extensions. Establish a systematic and comprehensive taxonomy of dangerous browser extension behaviors.
• Objective 2: Design novel, automated, and explainable methods to detect dangerous browser extensions, combining JavaScript static and lightweight dynamic analyses, predictive machine learning, and Large-Language Models. Provide interpretable and continuously adaptable detection models.
• Objective 3 (in collaboration with a postdoctoral researcher, to be recruited): Assess how different stakeholders (i.e., platform maintainers, developers, and users) understand and manage the underlying security and privacy risks of browser extensions.

Keywords: Web Security & Privacy, Browser Extensions, Dangerous Behavior Detection, Code Analysis, Applied Machine Learning, (Human Factors).

References:

[1] Abdullah Hassan Chaudhry, Valentino Dalla Valle, and Aurore Fass. Two Heads are Better Than One: Analysing Browser Extensions Across Stores. In MADWeb (workshop co-located with NDSS), 2026. Code repository: https://github.com/abdchau/two-heads-are-better

Compétences

Skills: A successful candidate for a PhD:

should have a strong background in Computer Science (Master degree or equivalent);

with a major ideally in Cybersecurity;

their research interests should be in Web Security, Web Privacy, or Web Measurements.

We are looking for a motivated student with:

solid programming skills in python;

(at least) a basic background in Web Security & Privacy; students with prior knowledge with Web-development technology (e.g., JavaScript), browser extensions, and browser architecture will be given priority;

some basic knowledge of Machine Learning is a plus;

proficiency in spoken and written English is a must (C1 level or higher); French knowledge is not necessary (note that English is the default language in the team);

we expect the student to be curious, creative, and have a strong willingness to learn and improve.

Avantages

Subsidized meals

Partial reimbursement of public transport costs

Leave: 7 weeks of annual leave + 10 extra days off due to RTT (statutory reduction in working hours) + possibility of exceptional leave (sick children, moving home, etc.)

Possibility of teleworking and flexible organization of working hours

Professional equipment available (videoconferencing, loan of computer equipment, etc.)

Social, cultural and sports events and activities

Access to vocational training

Employer-sponsored health insurance plan

Rémunération

Gross salary per month: 2300 €

36-month fixed-term contract

Postuler à cette offre

Partager

Facebook

Linkedin

Twitter

Email

Informations générales

Ville : Sophia Antipolis

Centre Inria : Centre Inria d'Université Côte d'Azur

Date de prise de fonction souhaitée : 2027-04-01

Durée de contrat : 3 ans

Date limite pour postuler : 2026-11-22

Attention: Les candidatures doivent être déposées en ligne sur le site Inria. Le traitement des candidatures adressées par d'autres canaux n'est pas garanti.

Consignes pour postuler

Sécurité défense :

Ce poste est susceptible d’être affecté dans une zone à régime restrictif (ZRR), telle que définie dans le décret n°2011-1425 relatif à la protection du potentiel scientifique et technique de la nation (PPST). L’autorisation d’accès à une zone est délivrée par le chef d’établissement, après avis ministériel favorable, tel que défini dans l’arrêté du 03 juillet 2012, relatif à la PPST. Un avis ministériel défavorable pour un poste affecté dans une ZRR aurait pour conséquence l’annulation du recrutement.

Politique de recrutement :

Dans le cadre de sa politique diversité, tous les postes Inria sont accessibles aux personnes en situation de handicap.

Contacts

Équipe Inria : AT-SOP

Directeur de thèse :

Fass Aurore /

L'essentiel pour réussir

How to apply: If you are interested in this PhD position, please apply by November 2, 2026 (11:59pm CET). You should provide:

An up-to-date CV;

A cover letter highlighting why you are applying for this position, why you would be a good fit for the research team and why you wish to join Inria. Generic application materials that do not demonstrate a genuine interest in the position (e.g., materials generated primarily using an LLM) will be ignored;

All available BSc and MSc transcripts, including, if available, your class ranking and/or ranking within your chosen specialization. International applicants are encouraged to include the grading scale, if available;

If you are currently pursuing your MSc degree: a scientific description of your ongoing or planned research internship, if applicable.

Otherwise, if you have completed your MSc degree: a copy of your Master's degree diploma and a summary of your MSc thesis (the thesis itself is not required);

Optionally: letters of recommendation or other documents that support the quality of your application.

All documents must be submitted in PDF format. Applications containing documents in other formats will not be considered. We strongly encourage applicants to submit their application materials in English, as all interviews will be conducted in English.

A propos d'Inria

Inria, l'institut national de recherche dans les sciences et technologies du numérique, est en appui de l’État pour les stratégies nationales de recherche et d’innovation du numérique en tant qu'Agence de programmes. Inria mène plus de 300 projets de recherche et d’innovation avec ses 3500 scientifiques, ingénieurs et personnels d’appui, en partenariat avec les universités et l’écosystème numérique (entreprises, entrepreneurs, acteurs publics). Ensemble, nous explorons des domaines clés comme l'intelligence artificielle, la cybersécurité, l’informatique quantique, le Cloud, la transformation numérique de la santé, les jumeaux numériques ou encore les technologies numériques pour la défense. Nous construisons des solutions concrètes telles que des logiciels, des startups technologiques, des partenariats avec les entreprises du tissu national et des formations de pointe. Notre objectif : l’impact scientifique, technologique et industriel au service de la souveraineté numérique de la France.

Plan du site

Contact

Mentions légales

Accessibilité : totalement conforme