PhD Position F/M Detecting Dangerous Browser Extensions to Protect the Security and Privacy of Web Users

PhD Position F/M Detecting Dangerous Browser Extensions to Protect the Security and Privacy of Web Users Download job offer in PDF format Contract type : Fixed-term contract Level of qualifications required : Graduate degree or equivalent Fonction : PhD Position About the research centre or Inria department Inria is the French National Institute for Research in Digital Science, of which the Inria Côte d'Azur University Center is a part. With strong expertise in computer science and applied mathematics, the research projects of the Inria Côte d'Azur University Center cover all aspects of digital science and technology and generate innovation. Based mainly in Sophia Antipolis, but also in Nice and Montpellier, it brings together 47 research teams and nine support services. It is active in the fields of artificial intelligence, data science, IT system security, robotics, network engineering, natural risk prevention, ecological transition, digital biology, computational neuroscience, health data, and more. The Inria Center at Université Côte d'Azur is a major player in terms of scientific excellence, thanks to the results it has achieved and its collaborations at both European and international level. Context The PhD position is funded by the French National Research Agency (ANR). It is part of Aurore Fass' ANR JCJC project "EXPELLIARMUS: Disarming Dangerous Browser Extensions to Protect the Security and Privacy of Web Users". EXPELLIARMUS, aims to develop methods to "disarm" dangerous extensions to better protect the security and privacy of Web users. More specifically, it will detect, understand, and mitigate dangerous browser extensions through an interdisciplinary approach combining computer science, human factors, and legal analysis. EXPELLIARMUS will deliver a systematic taxonomy of dangerous extension behaviors, open-source datasets and detection tools, as well as actionable recommendations for users, browser vendors, developers, and regulators. The PhD student will be part of the research team led by Dr. Nataliia Bielova (https://www-sop.inria.fr/members/Nataliia.Bielova/index.html) at the Inria Centre at Université Côte d’Azur at the French Riviera. The PhD student will be supervised by Dr.-Ing. Aurore Fass (https://aurore54f.github.io/). Note that a PhD in France typically lasts 3 years. Assignment Context on Browser Extension Security Given the central role of the Web in our daily lives and its overall impact on society and economy, it is crucial that Web pages and browser extensions assure the security and privacy of their large user base. Browser extensions have become an integral part of the modern Web ecosystem. The most popular desktop browser Chrome lists 280k browser extensions [1] (totaling almost 3 billion active users) in its official gallery, the Chrome Web Store [2]. Browser extensions enable users to enhance and customize their browsing experience: typically, extensions offer additional functionality to Web users, such as ad blocking (e.g., AdBlock), grammar checks (e.g., Grammarly), or password management (e.g., LastPass). To operate, browser extensions need elevated privileges compared to Web pages. Browser extensions can access sensitive user data, such as cookies or browsing history, and they can interact with arbitrary websites and other extensions [3, 4, 5]. While a compromised or malicious Web page is in itself troublesome, a malicious or vulnerable browser extension is much more powerful, as an attacker can leverage an extension's elevated privileges to cause more harm [3]. In particular, browser extensions can exfiltrate sensitive user data [6], track users online [7], or propagate unwanted software [8]. Detecting such threats at scale remains a challenge, as the extension ecosystem is particularly large, diverse, and continuously evolving. Limitations of existing work Abundant prior work attempted to detect some classes of dangerous extensions [9], e.g., malicious [10], vulnerable [3], or fingerprintable extensions [11]. However, related works have major limitations. Existing works analyze only hundreds of extensions [12], are outdated (e.g., 2012–2015 [8, 13, 14, 15]), have limited scalability and necessitate significant manual effort [16, 4], lack a clear characterization of what a dangerous behavior is [14]; and finally, only a small minority thereof is open source, as we have highlighted in [10]. Besides, existing machine learning-based detectors are opaque, they lack interpretability and explainability. It is therefore critical to design automated, large-scale, and reliable security and privacy analyses of browser extensions that have the potential to be deployed in the real world. References: [1] chrome-stats. Chrome extension statistics. https://chrome-stats.com/chrome/stats [2] Google. Chrome Web Store. https://chromewebstore.google.com [3] Aurore Fass, Dolière Francis Somé, Michael Backes, and Ben Stock. DoubleX: Statically Detecting Vulnerable Data Flows in Browser Extensions at Scale. In ACM CCS, 2021. Code repository: https://github.com/Aurore54F/DoubleX [4] Dolière Francis Somé. Empoweb: Empowering web applications with browser extensions. In IEEE S&P, 2019. [5] Jianjia Yu, Song Li, Junmin Zhu, and Yinzhi Cao. Coco: Efficient browser extension vulnerability detection via coverage-guided, con- current abstract interpretation. In ACM CCS, 2023. [6] Quan Chen and Alexandros Kapravelos. Mystique: Uncovering information leakage from browser extensions. In ACM CCS, 2018. [7] Michael Weissbacher, Enrico Mariconti, Guillermo Suarez-Tangil, Gianluca Stringhini, William Robertson, and Engin Kirda. Ex-ray: Detection of history-leaking browser extensions. In ACSAC, 2017. [8] Xinyu Xing, Wei Meng, Byoungyoung Lee, Udi Weinsberg, Anmol Sheth, Roberto Perdisci, and Wenke Lee. Understanding malvertising through ad-injecting browser extensions. In TheWebConf, 2015. [9] Sheryl Hsu, Manda Tran, and Aurore Fass. What is in the Chrome Web Store? Investigating Security-Noteworthy Browser Extensions. In ACM AsiaCCS, 2024. [10] Ben Rosenzweig, Valentino Dalla Valle, Giovanni Apruzzese, and Aurore Fass. It's not easy: Applying supervised machine learning to detect malicious extensions in the chrome web store. In ACM Transactions on the Web (TWEB), 2026. Code repository: https://github.com/its-not-easy/tweb25/tree/main [11] Shubham Agarwal, Aurore Fass, and Ben Stock. Peeking through the window: Fingerprinting browser extensions through page-visible execution traces and interactions. In ACM CCS, 2024. Code repository: https://github.com/raider-ext/raider [12] Nicholas Carlini, Adrienne Porter Felt, and David Wagner. An evaluation of the google chrome extension security architecture. In USENIX Security, 2012. [13] Nav Jagpal, Eric Dingle, Jean-Philippe Gravel, Panayiotis Mavrommatis, Niels Provos, Moheeb Abu Rajab, and Kurt Thomas. Trends and lessons from three years fighting malicious extensions. In USENIX Security, 2015. [14] Alexandros Kapravelos, Chris Grier, Neha Chachra, Christopher Kruegel, Giovanni Vigna, and Vern Paxson. Hulk: Eliciting malicious behavior in browser extensions. In USENIX Security, 2014. [15] Kurt Thomas, Elie Bursztein, Chris Grier, Grant Ho, Nav Jagpal, Alexandros Kapravelos, Damon Mccoy, Antonio Nappa, Vern Paxson, Paul Pearce, Niels Provos, and Moheeb Abu Rajab. Ad injection at scale: Assessing deceptive advertisement modifications. In IEEE S&P, 2015. [16] Nikolaos Pantelaios, Nick Nikiforakis, and Alexandros Kapravelos. You’ve changed: Detecting malicious browser extensions through their update deltas. In ACM CCS, 2020. Main activities Objectives of the PhD The broad objective of this PhD is to develop new automated tools to detect dangerous browser extensions, with a specific focus on malicious extensions. While the majority of prior work focuses on Chrome, we also want to study dangerous extensions on other browsers, such as Firefox and Edge, since we showed that the same malicious extensions can be published on multiple galleries [1]. - Objective 1: Generate a large-scale dataset of browser extensions. Establish a systematic and comprehensive taxonomy of dangerous browser extension behaviors. - Objective 2: Design novel, automated, and explainable methods to detect dangerous browser extensions, combining JavaScript static and lightweight dynamic analyses, predictive machine learning, and Large-Language Models. Provide interpretable and continuously adaptable detection models. - Objective 3 (in collaboration with a postdoctoral researcher, to be recruited): Assess how different stakeholders (i.e., platform maintainers, developers, and users) understand and manage the underlying security and privacy risks of browser extensions. Keywords: Web Security & Privacy, Browser Extensions, Dangerous Behavior Detection, Code Analysis, Applied Machine Learning, (Human Factors). References: [1] Abdullah Hassan Chaudhry, Valentino Dalla Valle, and Aurore Fass. Two Heads are Better Than One: Analysing Browser Extensions Across Stores. In MADWeb (workshop co-located with NDSS), 2026. Code repository: https://github.com/abdchau/two-heads-are-better Skills Skills: A successful candidate for a PhD: • should have a strong background in Computer Science (Master degree or equivalent); • with a major ideally in Cybersecurity; • their research interests should be in Web Security, Web Privacy, or Web Measurements. We are looking for a motivated student with: • solid programming skills in python; • (at least) a basic background in Web Security & Privacy; students with prior knowledge with Web-development technology (e.g., JavaScript), browser extensions, and browser architecture will be given priority; • some basic knowledge of Machine Learning is a plus; • proficiency in spoken and written English is a must (C1 level or higher); French knowledge is not necessary (note that English is the default language in the team); • we expect the student to be curious, creative, and have a strong willingness to learn and improve. Benefits package • Subsidized meals • Partial reimbursement of public transport costs • Leave: 7 weeks of annual leave + 10 extra days off due to RTT (statutory reduction in working hours) + possibility of exceptional leave (sick children, moving home, etc.) • Possibility of teleworking and flexible organization of working hours • Professional equipment available (videoconferencing, loan of computer equipment, etc.) • Social, cultural and sports events and activities • Access to vocational training • Employer-sponsored health insurance plan Remuneration Gross salary per month: 2300 € 36-month fixed-term contract Apply for this position Share • Facebook • Linkedin • Twitter • Email General Information • Town/city : Sophia Antipolis • Inria Center : Centre Inria d'Université Côte d'Azur • Starting date : 2027-04-01 • Duration of contract : 3 years • Deadline to apply : 2026-11-22 Warning : you must enter your e-mail address in order to save your application to Inria. Applications must be submitted online on the Inria website. Processing of applications sent from other channels is not guaranteed. Instruction to apply Defence Security : This position is likely to be situated in a restricted area (ZRR), as defined in Decree No. 2011-1425 relating to the protection of national scientific and technical potential (PPST).Authorisation to enter an area is granted by the director of the unit, following a favourable Ministerial decision, as defined in the decree of 3 July 2012 relating to the PPST. An unfavourable Ministerial decision in respect of a position situated in a ZRR would result in the cancellation of the appointment. Recruitment Policy : As part of its diversity policy, all Inria positions are accessible to people with disabilities. Contacts • Inria Team : AT-SOP • PhD Supervisor : Fass Aurore / aurore.fass@inria.fr The keys to success How to apply: If you are interested in this PhD position, please apply by November 2, 2026 (11:59pm CET). You should provide: • An up-to-date CV; • A cover letter highlighting why you are applying for this position, why you would be a good fit for the research team and why you wish to join Inria. Generic application materials that do not demonstrate a genuine interest in the position (e.g., materials generated primarily using an LLM) will be ignored; • All available BSc and MSc transcripts, including, if available, your class ranking and/or ranking within your chosen specialization. International applicants are encouraged to include the grading scale, if available; • If you are currently pursuing your MSc degree: a scientific description of your ongoing or planned research internship, if applicable. • Otherwise, if you have completed your MSc degree: a copy of your Master's degree diploma and a summary of your MSc thesis (the thesis itself is not required); • Optionally: letters of recommendation or other documents that support the quality of your application. All documents must be submitted in PDF format. Applications containing documents in other formats will not be considered. We strongly encourage applicants to submit their application materials in English, as all interviews will be conducted in English. About Inria Inria, the French national institute for research in digital science and technology, supports the French government in national research and innovation strategies in the digital field, acting as Digital Programs Agency. Inria leads over 300 research and innovation projects with its 3,500 scientists, engineers, and support staff, in partnership with universities and the digital ecosystem (businesses, entrepreneurs, and public stakeholders). Together, we explore strategic fields such as artificial intelligence, cybersecurity, quantum computing, cloud technologies, digital transformation in healthcare, digital twins, and digital technologies for defence. We develop practical solutions such as software, tech startups, partnerships with national companies, and cutting-edge training programmes. Our goal is to drive scientific, technological, and industrial excellence to ensure France’s digital sovereignty.