The Bugs BUIzz Finds

BUIzz's before-and-after experiment produces a discrepancy only when a browser UI transition changes an observed policy outcome. This chapter diagnoses what those discrepancies became in the study: which restrictions were weakened, what attacker capability followed, and why browser-specific UI features accounted for so many cases. The distinction between an alert and a confirmed security bug matters throughout, because a different result can be legitimate, stricter than intended, or already wrong before the interaction begins.

From an alert to a distinct policy failure

The study began with 23,987 pre/post-interaction inconsistencies. That number is a measure of observations, not a vulnerability count. The same underlying browser defect can appear across many pages, policy values, HTML tags, URL schemes, and interactions. Counting each observation separately would make a broad test corpus look like an enormous collection of unrelated bugs.

BUIzz first grouped inconsistencies using a three-part description: the browser UI interaction that triggered the behavior, the HTML tag or JavaScript API used for navigation, and the scheme of the navigated URL. The study then empirically merged groups when cross-referencing indicated a shared root cause. The process reduced 225 groups to 133 and produced 38 distinct bugs. This gives the reported total a causal interpretation: it is an attempt to count different implementation failures, not a simple total of every page that behaved unexpectedly.

The authors classified 35 of the 38 as security bugs and three as functional bugs. A security bug made enforcement less restrictive after the interaction than it should have been. A functional bug made enforcement stricter than intended. That distinction is necessary because a browser may correctly apply different rules to different browsing contexts. For example, a top-level navigation and a navigation inside an iframe can legitimately have different cookie behavior. The fact that an interaction changes an outcome is therefore the symptom. The policy and platform rules determine whether the symptom is a security weakness.

The 35 security bugs were distributed unevenly: 25 involved CSP enforcement, seven involved SameSite cookies, and one each involved Permissions Policy, COOP, and HSTS. The CSP total includes two different failure families. Eighteen bugs affected CSP's XSS-mitigation behavior, while seven affected the sandbox directive. This concentration tells us where the test corpus and the browser transitions were most revealing, but it does not mean CSP is the only policy worth testing. It means that the tested CSP pages supplied many ways to observe a lost restriction.

The clearest cases concern CSP and local-scheme navigation. On the initial page, a policy can authorize a particular script through a nonce while blocking a script without that authorization. BUIzz found 17 bugs in which mouse interactions navigated to blob: or data: URLs and the browser either failed to carry the parent CSP into the new context or improperly allowed a top-level data: navigation.