When Tracking Learns: Learning-Based Browser Fingerprinting Under Anti-Fingerprinting Defenses
(To appear) In ACM Conference on Computer and Communications Security (CCS), November 2026, The Hague, The Netherlands.
Xu Lin
“Walking to where the water ends, I sit and watch the clouds rise.”
Wang Wei, My Retreat at Mount Zhongnan
I am drawn to the seams of the web, where intention and exposure quietly diverge. My research traces how browser features and web applications leak sensitive information, enable tracking, and undermine account security. I also study the cat-and-mouse game between defenses and the techniques that bypass them, and develop countermeasures to close the gaps they uncover. Ultimately, I work toward a web where what is revealed is only what was meant.
I am an Assistant Professor in the School of Electrical Engineering and Computer Science at Washington State University.
Dispatches
- Paper on learning-based tracking accepted by CCS 2026.
- Paper on browser fingerprinting instability accepted by IMC 2026.
view earlier dispatches
- Your web browsing habits may be less private than you think, by Kim Martineau at IBM Blog.
- Paper on browser stylistic fingerprinting accepted by S&P 2023.
- Invited speaker for Antifraud / Web Payments at W3C’s 2022 Annual Conference.
- Awarded by Brave for finding a security bug in the Brave browser.
- Research internship at IBM Research.
- Paper on two-factor authentication accepted by USENIX Security 2022.
- Paper on form autofill entered the finalist of the CSAW’21 Applied Research Competition.
- Awarded by Google for finding a security bug in Chrome (CVE-2021-21181).
- Research internship at IBM Research.
- Paper on browser form autofill accepted by CCS 2020.
- Awarded by Google for finding a security bug in Chrome (CVE-2020-6521).
- Started PhD program at the University of Illinois Chicago.
- Accepted a fully funded PhD offer from the University of Illinois Chicago.
Publications
Eadem, Sed Aliter: Investigating the Instability of Browser Fingerprinting
(To appear) In ACM Internet Measurement Conference (IMC), October 2026, Karlsruhe, Germany.
In IEEE Symposium on Security and Privacy (S&P), May 2023, San Francisco, CA. (Acceptance rate: 17.0%)
Phish in Sheep’s Clothing: Exploring the Authentication Pitfalls of Browser Fingerprinting
In USENIX Security Symposium (USENIX Security), August 2022, Boston, MA. (Acceptance rate: 17.2%)
Fill in the Blanks: Empirical Analysis of the Privacy Threats of Browser Form Autofill
In ACM Conference on Computer and Communications Security (CCS), November 2020, Virtual. (Acceptance rate: 16.9%)
CSAW Applied Research Competition Finalist, 2021
Teaching
- CptS 425 · Cyber Forensics and Anti-Forensics
- CptS 580 · Web Security
- CptS 428 / 528 · Software Security and Reverse Engineering
Students
- Amir Khan · PhD · 2026–present
- Refaat Alamgir · PhD · 2025–present
- Jacob Eckfeldt · Master · 2024
Bug Bounty
- Brave Browser · a quiet bug ($150)
- Chromium Browser · CVE-2021-21181 ($5,000)
- Chromium Browser · CVE-2020-6521 ($500)