Tracking Measurement Obfuscations from SourceURL
This addresses a privacy and measurement issue for web developers and researchers by exposing a tracking obfuscation technique, though it is incremental as it builds on existing measurement platforms.
The paper identified that tracking scripts can use the sourceURL directive to obfuscate their origin in developer tools, affecting browsers like Firefox and Chromium, and noted that Firefox 78 introduced a preference to disable this behavior.
Tracking scripts can use the sourceURL directive to mask their origin from developer tools and tools that use the same JS call stack and network stack information. Firefox and Chromium appear to be affected. Firefox 78 now includes a preference to disable this behavior. This short paper describes the effect when using the OpenWPM measurement platform along with details of discovery.