Browser Event Listener Baselines for Compromised Web Page Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Web servers are vulnerable to attacks where malicious code is injected into web pages, allowing attackers to gather sensitive information from users without detection, compromising user security and privacy.

Innovation Solution

A browser extension detects event listeners added during the loading of web pages, comparing baseline data from a clean version with subsequent versions to identify changes indicative of compromise, and triggers threat response actions to protect users.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If web servers host web pages with web code that executes at client computing devices, then users can access and interact with web content, but attackers can insert malicious code into hosted web pages causing compromised web pages to serve malicious functionality

Engineering Contradiction:

Improveweb page functionalityVSAvoidmalicious code execution

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a browser extension as an intermediary layer between the compromised web page and the user's browser. This extension monitors web pages for malicious code execution by detecting changes in event listeners and comparing them against baseline data, thereby mediating the harmful effects before they reach the user.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary actions by establishing baseline data representing clean web pages before compromise occurs. When a web page is loaded, the extension captures the initial state of event listeners and compares subsequent states to detect malicious modifications, enabling early detection before user damage occurs.

Inventive Principle:

Principle #10Preliminary action

2Adaptability or versatility

If a browser loads third-party web code for advertising, trackers, social media, or other widgets, then web pages gain enhanced functionality and user engagement, but these resources can be compromised by attackers causing malicious code to execute at the user's computing device

Engineering Contradiction:

Improveweb page functionalityVSAvoidthird-party malicious code

Core Design Contradiction:

Adaptability or versatilityVSObject-generated harmful factors

Solution Approach 1:

The browser extension acts as an intermediary that monitors all web pages including those loading third-party resources. It detects when third-party code is compromised by monitoring for unauthorized changes in event listeners and comparing current states against established baselines, thereby protecting users from malicious third-party code execution.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If web servers serve compromised web pages without detection, then users may download malicious web code unknowingly, but detecting compromised pages requires monitoring and comparison of web page states

Engineering Contradiction:

Improveweb page securityVSAvoiddetection system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The browser extension performs self-service monitoring by automatically capturing baseline data when a web page is first loaded and continuously comparing subsequent loads against this baseline. This self-monitoring mechanism detects compromised pages without requiring complex external analysis systems, simplifying the detection architecture while maintaining high reliability.

Inventive Principle:

Principle #25Self-service

4Measurement precision

If the detection system compares baseline data with subsequent web page data to identify changes, then compromised pages can be detected, but this requires continuous monitoring and data processing

Engineering Contradiction:

Improvecompromise detection accuracyVSAvoidmonitoring time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The browser extension maintains continuous monitoring by persistently comparing subsequent web page loads against captured baseline data. This continuous action ensures that even subtle or delayed compromises are detected, maintaining high measurement precision while the efficient comparison algorithm minimizes time loss through rapid state differentiation.

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentUS12627709B2Detecting compromised web pages in a runtime environment

Publication Date: 2026.05.12 SHAPE SECURITY INC

AI summary

Techniques are provided for detecting compromised web pages in a runtime environment. A first version of a web page is retrieved and loaded in a browser comprising a browser extension configured to detect event listeners added when web pages are loaded by the browser. First data is generated describing a first set of event listeners detected by the browser extension when the first version of the web page is loaded. At a second time a second version of the web page is retrieved and loaded in the browser. Second data is generated describing a second set of event listeners detected by the browser extension when the second version of the web page is loaded. It is determined that the web page is compromised based on comparing the first data and the second data. In response to determining that the web page is compromised, a threat response action is performed.