What Browsers Do in the Shaders: A Measurement Study of WebGPU Privacy

• URL: http://arxiv.org/abs/2606.26412v1
• Date: Wed, 24 Jun 2026 22:11:06 GMT
• Title: What Browsers Do in the Shaders: A Measurement Study of WebGPU Privacy
• Abstract summary: WebGPU lets ordinary web pages run GPU workloads through a validated programming model.<n> Validation protects memory safety, but shared browser, driver, OS, and GPU state can still expose privacy-relevant signals.<n>We present WGPULens, a framework for measuring those signals across controlled scenarios, browser-native co-residency, a participant field study, public page loads, and mitigation policies.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: WebGPU lets ordinary web pages run GPU workloads through a validated programming model. Validation protects memory safety, but shared browser, driver, OS, and GPU state can still expose privacy-relevant signals. We present WGPULens, a framework for measuring those signals across controlled scenarios, browser-native co-residency, a participant field study, public page loads, and mitigation policies. Our framework separates measurements: controlled scenarios support leakage, boundary, and mitigation claims; participant runs support deployment, compatibility, and fingerprintability; and a Tranco crawl measures WebGPU exposure in real-world pages. Our controlled results identify persistent pipeline compilation state as the clearest surface. Cold/warm pipeline probes reveal prior compilation state across selected origin, profile, and browser placements. Controlled browser/native experiments also show native GPU activity can be inferred from browser-visible observables under labeled workloads. Other resource probes provide weaker positive results and negative controls. The participant field study shows active WebGPU behavior is highly distinctive within the sample, with deterministic components stable within runs and lower exact stability across repeated visits. A page-load crawl finds WebGPU use mainly as adapter probing and static support code, with no observed page-load shader, pipeline, queue, query, or map activity. Mitigation pilots identify source-level key separation as a proxy for evaluating pipeline-cache partitioning. Overall, WGPULens shows that WebGPU privacy analysis must be surface-specific: browsers need to measure which GPU state crosses which boundary, which browser-visible signals reveal it, and what the corresponding mitigations cost.

Related papers

• BrowserForge: Scaling Web Episode via Parallel Browser Sandboxes [54.96895469970198]
  BrowserForge generates web interaction data at scale by driving many browser sandboxes in parallel over the open web.<n> BrowserForge couples three components: an open-web sourcing stage that exposes the agent to hundreds of thousands of real, openly reachable websites.<n>A rule-plus-model cleaning pipeline removes failed runs and rewrites the surviving reasoning into a single unified chain-of-thought style.
  arXiv  Detail & Related papers  (2026-08-25T17:35:42Z)
• Measuring and Reducing WebGPU Dispatch Overhead for LLM Inference [0.0]
  We introduce a sequential-dispatch measurement method and show that naive single-operation measurements overestimate per-dispatch cost.<n>We show that the dispatch overhead, not kernel quality, is the bottleneck at batch size 1, and isolate the dispatch count as the cause.
  arXiv  Detail & Related papers  (2026-08-09T14:21:55Z)
• Rendering on Real Silicon: GPU Render-Timing as a Passive, AI-Resistant CAPTCHA Signal [4.02431279819382]
  We measure render-timing dynamics to classify rather than identify, leaking no persistent identifier.<n>We characterize the in-the-wild adversary with a 12-hour passive deployment.<n>We report these as pilot-scale findings on a single GPU architecture.
  arXiv  Detail & Related papers  (2026-07-25T23:10:24Z)
• WarpGuard: Towards Control-Flow Attestation for Heterogeneous CPU-GPU Execution [5.687515869589544]
  We present WarpGuard, the first composite CFA framework for heterogeneous CPU-GPU workloads.<n>It verifies execution against a unified control-flow graph (CFG) that captures both CPU and GPU components.<n>We implement WarpGuard using software-based instrumentation, requiring no specialized hardware or binary modifications.
  arXiv  Detail & Related papers  (2026-07-15T09:32:43Z)
• WebTestBench: Evaluating Computer-Use Agents towards End-to-End Automated Web Testing [57.7131457251794]
  We introduce WebTestBench, a benchmark for evaluating end-to-end automated web testing.<n>We decompose the testing process into two cascaded sub-tasks, checklist generation and defect detection, and propose WebTester.<n>Our findings expose a substantial gap between current computer-use agent capabilities and industrial-grade deployment demands.
  arXiv  Detail & Related papers  (2026-03-26T09:27:29Z)
• GPU-Accelerated Algorithms for Graph Vector Search: Taxonomy, Empirical Study, and Research Directions [54.570944939061555]
  We present a comprehensive study of GPU-accelerated graph-based vector search algorithms.<n>We establish a detailed taxonomy of GPU optimization strategies and clarify the mapping between algorithmic tasks and hardware execution units.<n>Our findings offer clear guidelines for designing scalable and robust GPU-powered approximate nearest neighbor search systems.
  arXiv  Detail & Related papers  (2026-02-10T16:18:04Z)
• WebSplatter: Enabling Cross-Device Efficient Gaussian Splatting in Web Browsers via WebGPU [15.600893263003053]
  WebSplatter is an end-to-end GPU rendering pipeline for the heterogeneous web ecosystem.<n>WebSplatter consistently achieves 1.2$times$ to 4.5$times$ speedups over state-of-the-art web viewers.
  arXiv  Detail & Related papers  (2026-02-03T07:18:40Z)
• Visionary: The World Model Carrier Built on WebGPU-Powered Gaussian Splatting Platform [104.39464309969253]
  We present Visionary, an open, web-native platform for real-time various Gaussian Splatting and rendering.<n> Visionary enables dynamic neural processing while maintaining a lightweight, "click-to-run" browser experience.
  arXiv  Detail & Related papers  (2025-12-09T10:54:58Z)
• Scalable GPU-Based Integrity Verification for Large Machine Learning Models [4.301162531343759]
  We present a security framework that strengthens distributed machine learning by standardizing integrity protections across CPU and GPU platforms.<n>Our approach co-locates integrity verification directly with large ML model execution on GPU accelerators.<n>We provide a hardware-agnostic foundation that enterprise teams can deploy regardless of their underlying CPU and GPU infrastructures.
  arXiv  Detail & Related papers  (2025-10-27T23:45:21Z)
• BrowserArena: Evaluating LLM Agents on Real-World Web Navigation Tasks [51.803138848305814]
  We introduce BrowserArena, a live open-web agent evaluation platform that collects user-submitted tasks.<n>We identify three consistent failure modes: captcha resolution, pop-up banner removal, and direct navigation to URLs.<n>Our findings surface both the diversity and brittleness of current web agents.
  arXiv  Detail & Related papers  (2025-10-02T15:22:21Z)
• OST-Bench: Evaluating the Capabilities of MLLMs in Online Spatio-temporal Scene Understanding [50.72259772580637]
  We introduce OST-Bench, a benchmark designed to evaluate Online Spatio-Temporal understanding from the perspective of an agent.<n>Built on an efficient data collection pipeline, OST-Bench consists of 1.4k scenes and 10k question-answer pairs collected from ScanNet, Matterport3D, and ARKitScenes.<n>We find that both complex-based spatial reasoning demands and long-term memory retrieval requirements significantly drop model performance along two separate axes.
  arXiv  Detail & Related papers  (2025-07-10T17:56:07Z)
• VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents [74.6761188527948]
  Computer-Use Agents (CUAs) with full system access pose significant security and privacy risks.<n>We investigate Visual Prompt Injection (VPI) attacks, where malicious instructions are visually embedded within rendered user interfaces.<n>Our empirical study shows that current CUAs and BUAs can be deceived at rates of up to 51% and 100%, respectively, on certain platforms.
  arXiv  Detail & Related papers  (2025-06-03T05:21:50Z)
• Browser Fingerprinting Using WebAssembly [1.4732811715354452]
  This paper introduces an advanced fingerprinting method using WebAssembly (Wasm)<n>We present a new approach that leverages WebAssembly's computational capabilities to identify returning devices across different browsing sessions.<n>We validate this approach on a variety of platforms, including Intel, AMD, and ARM CPUs, operating systems such as Windows, Android, and iOS, and in environments like VMWare, KVM, and iOS.
  arXiv  Detail & Related papers  (2025-05-31T21:39:17Z)
• DarthShader: Fuzzing WebGPU Shader Translators & Compilers [19.345967816562364]
  A recent trend towards running more demanding web applications has led to the adoption of the WebGPU standard. This opens up a new attack surface: Untrusted web content is passed through to the GPU stack, which traditionally has been optimized for performance instead of security. DarthShader is the first language fuzzer that combines mutators based on an intermediate representation with those using a more traditional abstract syntax tree.
  arXiv  Detail & Related papers  (2024-09-03T12:06:19Z)
• WebGPU-SPY: Finding Fingerprints in the Sandbox through GPU Cache Attacks [0.7400926717561453]
  We present a new attack vector for microarchitectural attacks in web browsers. We develop a cache side channel attack on the compute stack of the GPU that spies on victim activities. We demonstrate that GPU-based cache attacks can achieve a precision of 90 for website fingerprinting of 100 top websites.
  arXiv  Detail & Related papers  (2024-01-09T04:21:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.