Our new paper on “Demystifying Progressive Web Application Permission Systems” is going to appear in DSN’26! Progressive Web Applications (PWAs) are web-based applications that bring native-app features such as offline access, notifications, and installability to the browser, making them an increasingly important part of today’s web ecosystem. In this work, we developed Permissioner to systematically analyze permission handling in PWAs and uncovered numerous security issues of inconsistency, incompleteness, and unclear boundaries in permission enforcement, with concrete cases of permission leakage, across browsers and platforms. Our findings have already led to fixes in Firefox and a Chromium patch, highlighting the urgent need for a unified and robust PWA permission model.
Congratulations, Mengxiao & Jianwei!