browser extension development

This study addresses the unique challenges faced by non-developer-led knowledge communities—such as Obsidian—in maintaining sustainable plugin ecosystems, a domain lacking systematic understanding. Through an empirical investigation of 396 plugins, combining repository mining, large language model–driven topic modeling, and pull request analysis, this work presents the first systematic characterization of such ecosystems. It identifies six functional theme categories and reveals active software evolution patterns. Furthermore, the research proposes an analytical framework tailored for plugin maintenance in mixed-skill communities, articulating three strategic directions and six key research questions. The findings demonstrate that even non-developer communities can cultivate plugin ecosystems with discernible engineering structure and long-term sustainability.

This study identifies systematic privacy protection failures in mainstream web privacy tools (e.g., uBlock Origin, Privacy Badger) when handling local frames—particularly `about:blank` iframes—enabling fingerprinting, cookie theft, and data exfiltration attacks that evade detection. Method: We conduct a multi-faceted empirical analysis including large-scale web security measurement, iframe origin semantics analysis, black-box functional testing, filter rule efficacy evaluation, and cross-tool vulnerability validation. Contribution/Results: We are the first to systematically characterize the anomalous interaction between local frames and browser privacy boundaries. We distill 19 cross-tool vulnerability patterns rooted in the incompatibility between legacy web features (e.g., relaxed same-origin policy for `about:blank`) and modern privacy models. All six evaluated tools exhibit at least one exploitable flaw. Measurement across the top 10K websites reveals that 56% employ local frames, and among them, 14.3% host malicious requests that bypass intended filtering—demonstrating widespread real-world impact.

This study addresses the critical challenge of preserving user privacy while maintaining the usability of web services such as advertising. It presents the first large-scale, longitudinal empirical analysis of the Privacy Sandbox initiative and its associated Web APIs, leveraging seven years of historical HTTP Archive crawl data alongside Chrome’s public telemetry to track adoption across the CrUX Top 100K websites. The findings reveal persistently low and highly concentrated API adoption among a small set of actors, fragmented deployment patterns, and significant divergence in privacy policy implementation across browsers. Notably, Chrome’s privacy protections remain heavily contingent on user-initiated opt-ins. These results illuminate the underlying incentives and risks shaping stakeholder behavior and offer actionable insights for the design of future privacy-enhancing technologies.

This study systematically uncovers, for the first time, security risks arising from JavaScript (JS) inclusions in Chrome extensions—highlighting critical environmental differences from regular web contexts and a longstanding lack of comprehensive empirical analysis. To address this gap, we propose a hybrid static-dynamic analysis framework: static analysis combines abstract syntax tree (AST) parsing with inter-procedural data-flow path tracing; dynamic analysis integrates runtime script-injection detection and network request monitoring. Applied to 36,324 real-world extensions, our framework identifies 350,784 JS inclusions, confirms 22 exploitable remote script loading vulnerabilities, and reveals widespread reliance on high-risk, outdated libraries (e.g., jQuery 1.x, Underscore 1.4.x) across mainstream extensions. These findings fill a critical gap in browser extension JS supply-chain security research and provide an empirical foundation and methodological support for extension vetting, automated vulnerability detection, and security governance.

To address copyright infringement in text-to-image generation, this paper proposes ©-Plugin, a fine-grained, traceable, revocable, and composable copyright authorization framework. Methodologically, it introduces Reverse LoRA—a novel technique for reverse-engineering stylistic or intellectual property (IP) features from pre-trained models—and integrates it with EasyMerge, a low-rank fusion method enabling seamless embedding of copyright modules into both training and inference pipelines. The framework unifies LoRA-based fine-tuning, reverse gradient optimization, and style/IP-directed distillation to support cross-model copyright transfer and precise attribution. Extensive evaluation on artist-style replication and cartoon IP reconstruction demonstrates its effectiveness. The implementation is publicly available.

This study addresses the limitations of traditional social media data collection methods, which are often cumbersome, context-disconnected, and prone to failure due to frequent changes in page structures—thereby compromising ecological validity. To overcome these challenges, this work proposes a self-healing browser extension that enables non-technical researchers to conduct code-free annotation and intervention experiments directly within native platform interfaces. The system innovatively integrates a large language model–driven self-healing mechanism capable of automatically detecting and repairing selectors to support robust capture of dynamic content. It also features a no-code form designer and a cross-platform injection framework. Validated across twelve major social media platforms, the approach significantly reduces data collection and maintenance costs while empowering researchers to carry out high-quality studies efficiently.

This study addresses the underexplored role of UI/UX designers in organizational privacy practices, a dimension often overlooked in favor of developer-centric approaches. Through semi-structured interviews with twelve privacy-advocating UI/UX designers and subsequent thematic analysis, the research systematically investigates their privacy-related perceptions, influencing factors, cross-functional collaboration challenges, and coping strategies. It reveals, for the first time, how designers navigate tensions among business objectives, technical constraints, and team dynamics through value-driven and adaptive approaches. The study identifies how individual characteristics and organizational contexts shape privacy advocacy, elucidates mechanisms of friction in interdisciplinary collaboration, and proposes designer-centered pathways for organizational change alongside actionable tooling recommendations. These findings offer both theoretical insights and practical foundations for fostering privacy-supportive design ecosystems.

This study addresses the widespread yet often unintentional leakage of sensitive information—such as private URLs, API keys, and Git history—in arXiv preprint source files, posing significant risks to author privacy and security. Conducting the first large-scale quantitative analysis of 2.7 million arXiv submissions, we systematically identify leakage vulnerabilities across three dimensions: redundant files, embedded metadata, and irrelevant code comments. To mitigate these risks, we introduce ALC-NG, the first comprehensive sanitization tool capable of simultaneously cleaning auxiliary files, metadata, and source-code annotations. ALC-NG integrates automated static analysis, metadata extraction, textual pattern recognition, and LaTeX compilation validation. Our experiments reveal that nearly all submissions contain hidden sensitive data, that existing tools offer limited protection, and that ALC-NG effectively removes unnecessary content while preserving successful document compilation.

This work addresses the challenges of manual GitHub dataset construction, where evidence and annotations are scattered across multiple sources, hindering traceability and collaborative auditing. The authors propose the first end-to-end framework that integrates browser-assisted data collection, local structured storage, and decision provenance tracking. Leveraging a Chrome extension to capture page snapshots, comments, and labels, the system couples an Express backend with a React dashboard to consolidate all research decisions into a unified SQLite workspace, tightly linking evidence with explanatory context. Evaluated on the Matplotlib project, the framework successfully collected 22 snapshots, 38 comments, and 98 annotations across 20 issues, fully preserving the research process and enabling conflict simulation. This approach substantially enhances the auditability and reproducibility of dataset construction.

This study addresses the accountability gap in human-AI collaborative creation, specifically the disparity between “disclosure” and “attribution.” While students increasingly disclose their use of generative AI—rising from 0% to 66% across three academic terms from 2022 to 2025—they rarely specify its actual contributions. Drawing on longitudinal data from a graduate course, including 203 GitHub repositories and 23,065 commits, combined with computational analysis and qualitative case studies, the work proposes a two-tiered “disclosure–attribution” accountability framework. Findings reveal that by 2025, AI had become embedded as course infrastructure; however, current norms centered solely on disclosure are insufficient for managing the persistent, ambient nature of AI collaboration. The study thus provides an empirical foundation for developing fine-grained mechanisms of accountable AI co-creation.