CySec Researchers contribute to the 35th USENIX Security Symposium
The USENIX Security Symposium is a prestigious conference in the field of computer security and privacy, drawing researchers, practitioners, system administrators, developers, and security experts from around the world. It provides a vital platform for exploring the latest breakthroughs and innovations in system and network security. After two presentations in 2024 and five in 2025, CySec’s presence at the USENIX Security Symposium expanded further in 2026, with researchers presenting or contributing to six works. Three of them focused on current challenges and advances in mobile, web, and messaging security.
Riccardo Lamarca, Philipp Beer, and Marco Squarcina presented “AutoFail: Breaking Web Boundaries using Android’s Autofill Framework,” a systematic security analysis of how Android browsers and password managers interact through the Autofill Framework. Password managers on Android rely on this framework to insert saved credentials into apps and websites. In browsers, however, website content must first be translated from the browser’s Document Object Model into an Android-specific representation. The researchers show that weaknesses in this translation process and in password managers’ credential-handling logic can create serious security risks.
To investigate the problem, the team developed ADAPT, a differential-testing framework that examines the complete autofill process from browser translation to credential matching and filling. Their analysis uncovered six security issues arising from implementation flaws in widely used browsers and password managers, with vulnerabilities affecting nine password managers and five mobile browsers overall. The identified attacks can, under specific conditions, expose credentials to attacker-controlled websites, bypass web isolation mechanisms, and reveal relationships between user accounts across different services. Real-world case studies involving Kick, AOL, and the Internet Archive demonstrated that the attacks are practically feasible. The researchers also examined additional risks involving potentially unwanted applications and cross-context information leakage. Alongside identifying the vulnerabilities, they proposed concrete mitigations and a standardized design for safer DOM translation and context-aware credential filling. The findings were disclosed to affected vendors, and major browser and password manager developers confirmed the issues and began implementing fixes.
Further examining security risks where Android applications interact with web technologies, Philipp Beer, together with Martina Lindorfer, Marco Squarcina, and Sebastian Roth (University of Bayreuth), presented “Plain Text, Plain Risks: Measuring HTTP Inclusion in Android WebViews at Scale,” the first large-scale study of insecure HTTP use in Android WebViews. While HTTPS has become standard on the traditional Web, embedded web content inside mobile apps often lacks comparable visual warnings and allows developers greater control over transport security. To assess the resulting risks, the researchers analyzed 189,779 Google Play apps and found that 33.74% explicitly disable Android’s default blocking of HTTP traffic. A dynamic analysis of 35,000 apps further showed that 69.96% of those opting out also weaken the Mixed Content Policy, with active HTTP traffic observed in 2,790 applications.
The findings show that these configurations can create serious practical vulnerabilities. The researchers identified popular apps with more than 10 million installations that could be exposed to attacks ranging from phishing to complete app takeover, as well as a major advertising library transmitting ads over unencrypted connections and potentially exposing very large numbers of users to machine-in-the-middle attacks. The study also found that insecure settings are often introduced by third-party advertising SDKs and hybrid frameworks, while developers may not fully understand the security implications of WebView configuration options. According to the analysis, 66.13% of the insecure HTTP URLs found in vulnerable apps could have been automatically upgraded if Android WebView applied mechanisms already used by modern browsers. The authors therefore recommend stricter handling of HTTP and mixed content in WebViews, clearer security indicators for users, and stronger developer-side checks for cleartext network traffic.
Hien Chu presented “Anamorphic Messaging: Analyzing the Double Ratchet, Triple Ratchet, PQ3, and MLS,” developed together with Alessandro Corsi and Paul Rösler (FAU Erlangen-Nürnberg). The study examines how secret messages can be hidden inside otherwise legitimate encrypted communication, even in a restrictive scenario where an adversary can monitor all traffic and require users to reveal their regular cryptographic keys. Anamorphic cryptography addresses this challenge by embedding covert information into carefully selected elements of existing protocols using an additional secret state.
The researchers extend this concept to stateful messaging protocols and introduce a model that provides forward security, robustness, and authenticity for anamorphic communication. They analyze Signal’s Double Ratchet and Triple Ratchet, Apple’s PQ3, and the two-party core of the Messaging Layer Security standard. The study shows that all four protocols can support forward-secure and authenticated hidden channels, even if the adversary later obtains the secret state. The available covert bandwidth varies considerably across the protocols: 16 bits per epoch in Double Ratchet, 176 bits in Triple Ratchet, 256 bits in PQ3, and 688 bits per epoch in MLS. The results establish a systematic basis for understanding covert communication capabilities in modern secure-messaging protocols under strong surveillance and key-compromise assumptions.
