[Black Hat] A Tool to Query a User's Cache

In March 2007, I published an exploit on this blog that sparked intense debate across the Italian tech community: an automated tool capable of querying browser state to determine which external domains a visitor had previously accessed, assembling an accurate professional profile without form submissions or user consent.

At the time, I deliberately withheld the underlying source code: the implementation exposed a severe privacy boundary flaw, and the objective was demonstrating browser architectural vulnerability rather than facilitating indiscriminate exploitation.

How did the exploit actually operate under the hood?

The attack vector weaponized an inherent flaw in legacy implementations of the CSS :visited pseudo-class:

• In pre-2010 web browsers (Firefox, Internet Explorer, early Safari), hyperlinks matching URLs stored in user history rendered distinctive visual properties (e.g. unique text colors or background rules).
• Client-side JavaScript injected hundreds of hidden <a> elements into the DOM referencing specific targets, querying rendered style metrics via window.getComputedStyle(element).color or profiling local cache access timings.
• If the computed color matched the designated :visited declaration, the script obtained deterministic confirmation that the user had previously browsed that exact URI.

To demonstrate the practical implications, I curated a calibration set of 200 distinctive target URLs partitioned into four professional archetypes:

• SEO Specialists: specialized forums (GiorgioTave, Html.it, WebmasterWorld), ranking tools;
• Web Marketers: advertising networks, affiliate dashboards, marketing publications;
• Web Developers: language specifications, PHP documentation, W3C repositories;
• Bloggers: publishing engines, feed aggregators, syndication networks.

Within seconds of asynchronous background execution, the script computed match ratios against each bucket, returning probabilistic persona scores with striking accuracy (e.g. «74% SEO, 40% Marketer, 12% Developer»).

This category of vulnerability (formally classified in security research as CSS History Sniffing and Cache Timing Attacks) was permanently neutralized beginning around 2010:

• Browser vendors (Mozilla, Google, Apple) revised W3C standards: style inspection APIs (getComputedStyle) strictly return :link baseline styles regardless of real visit history.
• Modern engines implemented Network Cache Partitioning, segregating cached resources across top-level site origins and rendering cross-site timing attacks obsolete.