Over the past few years, a significant effort went into the development of a new generation of web standards, centered around the HTML5 specification. Given the importance of the web in our society, it is essential that these new standards are scrutinized for potential security problems. This paper reports on a systematic analysis of ten important, recent specifications with respect to two generic security goals: (1) new web mechanisms should not break the security of existing web applications, and (2) different newly proposed mechanisms should interact with each other gracefully. In total, we found 45 issues, of which 12 are violations of the security goals and 31 issues concern under-specified features. Additionally, we found that 6 out of 11 explicit security considerations have been overlooked/overruled in major browsers, leaving secure specifications vulnerable in the end. All details can be found in an extended version of this paper (De Ryck et al., 2012) .
De Ryck et al. scrutinized in REF new HTML5 standards for potential security problems and carried out a systematic analysis on how new web mechanisms might break the security of existing web applications, and how gracefully different newly proposed mechanisms interact with each other.
A security analysis of emerging web standards - HTML5 and friends, from specification to implementation
SECRYPT
Computer Science