[Paper Review] Browser Feature Usage on the Modern Web

Peter Snyder, Lara Ansari+2 more|arXiv (Cornell University)|May 20, 2016

Spam and Phishing Detection13 references4 citations

TL;DR

This paper analyzes browser feature usage on the modern web by examining JavaScript API utilization across the top 10,000 websites, revealing that over 50% of features are never used. It further shows that ad and tracking blockers prevent execution of approximately 10% of features over 90% of the time, with 83% of features used on less than 1% of sites when blockers are active, highlighting a significant disconnect between available functionality and actual usage, especially under privacy-preserving extensions.

ABSTRACT

Modern web browsers are incredibly complex, with millions of lines of code and over one thousand JavaScript functions and properties available to website authors. This work investigates how these browser features are used on the modern, open web. We find that JavaScript features differ wildly in popularity, with over 50% of provided features never used in the Alexa 10k. We also look at how popular ad and tracking blockers change the distribution of features used by sites, and identify a set of approximately 10% of features that are disproportionately blocked (prevented from executing by these extensions at least 90% of the time they are used). We additionally find that in the presence of these blockers, over 83% of available features are executed on less than 1% of the most popular 10,000 websites. We additionally measure a variety of aspects of browser feature usage on the web, including how complex sites have become in terms of feature usage, how the length of time a browser feature has been in the browser relates to its usage on the web, and how many security vulnerabilities have been associated with related browser features.

Motivation & Objective

• To understand the actual usage patterns of browser features across the modern web, particularly among the most popular websites.
• To investigate how ad and tracking blockers alter browser feature utilization, especially in terms of feature blocking frequency and distribution.
• To assess the relationship between feature popularity, longevity, and security vulnerabilities in web browsers.
• To evaluate the impact of privacy-preserving extensions on the execution of browser APIs, particularly those related to tracking and advertising.
• To examine whether widely used, complex websites rely on a broader or narrower set of browser features compared to less popular sites.

Proposed method

• The authors collected and analyzed JavaScript feature usage from the top 10,000 websites in the Alexa ranking using a custom web crawler and static analysis of JavaScript code.
• They categorized browser features into standards-based API families and measured usage frequency across the dataset.
• The study evaluated the impact of popular ad and tracking blockers (e.g., uBlock Origin, Privacy Badger) by measuring feature execution rates with and without these extensions.
• They used a monkey testing approach to elicit feature usage across the open web, simulating user interactions to detect hidden or rarely triggered features.
• The researchers correlated feature usage with security vulnerability data (CVEs) to assess the risk profile of underused or blocked features.
• They analyzed the relationship between feature age (time since introduction) and usage frequency to assess adoption trends.

Experimental results

Research questions

• RQ1 How frequently are browser features used across the top 10,000 websites, and what is the distribution of usage across different feature types?
• RQ2 To what extent do ad and tracking blockers prevent the execution of specific browser features, and which features are most commonly blocked?
• RQ3 How does the presence of content blockers affect the overall distribution of feature usage, particularly for less popular or newer features?
• RQ4 Is there a correlation between the age of a browser feature and its usage frequency on the modern web?
• RQ5 What is the relationship between feature popularity and the number of associated security vulnerabilities (CVEs)?

Key findings

• Over 50% of the JavaScript features available in modern browsers are never used on any of the top 10,000 websites in the Alexa ranking.
• Approximately 10% of browser features are blocked from executing by ad and tracking blockers in at least 90% of cases where they are used.
• In the presence of popular blockers, over 83% of browser features are executed on less than 1% of the most popular 10,000 websites.
• The study identifies 15 standards (20% of all standards) that are completely unused when blockers are active, and 31 standards (41%) used on less than 1% of sites.
• Features that are heavily blocked are still associated with a significant number of security vulnerabilities, indicating that unused or blocked features still pose a security risk.
• Despite widespread blocking, the most popular websites remain functional and popular, suggesting the web’s programming model is highly resilient to feature removal.