English

Poster: Mind the Gap -- Characterizing the Temporal Blind Spot Between GSB and DNS Resolution

Cryptography and Security 2026-07-07 v1

Abstract

Google Safe Browsing (GSB) and DNS resolution operate concurrently during browser navigation, yet their packet-level synchronization remains understudied. This work characterizes the timing gap (Δtime\Delta_{time}) between GSB-related query close events and parallel DNS resolution responses, identifying a consistent temporal offset with potential security relevance. Using packet-capture analysis across general and CNAME-domain datasets, we observe positive timing gaps in approximately 79\% of measurements. In these instances, DNS responses lag behind GSB-related query closures with median delays of 67-79 ms and maximum delays surpassing 2,400 ms. These empirical results highlight a measurable window within the browsing workflow. We suggest that such temporal inconsistencies, particularly in complex CNAME-domain resolutions, may create a security-relevant timing precondition under DNS-manipulation threat models. These results provide a foundation for further research into timing-based risks and mitigations in browser safety mechanisms.

Cite

@article{arxiv.2607.06134,
  title  = {Poster: Mind the Gap -- Characterizing the Temporal Blind Spot Between GSB and DNS Resolution},
  author = {Tomer Gal and Fujiao Ji and Doowon Kim and Harel Israel Berger},
  journal= {arXiv preprint arXiv:2607.06134},
  year   = {2026}
}

Comments

To appear in the proceedings of the 23rd Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA '26)

R2 v1 2026-07-22T20:28:03.721Z