Extending Browser Extension Fingerprinting to Mobile Devices

Brian Hyeongseok Kim, Muhammad Shujaat Mirza, Christina Pöpper

Abstract: Browser extensions are tools that extend basic browser features to enhance web experience. It has been shown that extensions can be exploited to fingerprint users and even infer personal information about them. However, as browser extensions have been limited to desktops previously, no prior work has explored fingerprintability of extensions on mobile devices, despite the increasing extension support for mobile browsers. This paper aims to fill this gap by extending extension fingerprinting techniques, traditionally performed on desktops, to mobile phones. Out of the 16 chosen extensions, we discover that 6 extensions are uniquely identifiable by their client-side modifications. We present our experimental results through our evaluation of variable interactions between various browsers, devices, and extension lists, and investigate how shifting the attention from the list of installed extensions to the actual modification data can help attackers discriminate users better.