  Browsers use security policies to block malicious behaviors. Cross-Origin
Read Blocking (CORB) is a browser security policy for preventing side-channel
attacks such as Spectre. We propose a web browser security policy fuzzer called
CorbFuzz for checking CORB and similar policies. In implementing a security
policy, the browser only has access to HTTP requests and responses, and takes
policy actions based solely on those interactions. In checking the browser
security policies, CorbFuzz uses a policy oracle that tracks the web
application behavior and infers the desired policy action based on the web
application state. By comparing the policy oracle with the browser behavior,
CorbFuzz detects weaknesses in browser security policies. CorbFuzz checks the
web browser policy by fuzzing a set of web applications where the state-related
queries are symbolically evaluated for increased coverage and automation.
CorbFuzz collects type information from database queries and branch conditions
in order to prevent the generation of inconsistent data values during fuzzing.
We evaluated CorbFuzz on CORB implementations of Chromium and Webkit, and
Opaque Response Blocking (ORB) policy implementation of Firefox using web
applications collected from GitHub. We found three classes of weaknesses in
Chromium's implementation of CORB.
