demo · v139
Sidechannel Leak
The xsleaks attack the v139 experiment is exploring: a malicious tab saturates the shared TCP pool, then opens the victim. If the victim makes more requests than free slots allow, those requests stall — observable timing → leaked state. Move the slider and watch the attacker's verdict change.
simulation parameters
256
250
6 sockets if logged in, half that if logged out
pool usage
attacker baseline
+ victim (logged in)
+ victim (logged out)
free slots: —
attacker's verdict from timing
—
if the in-state request count overflows the pool, those connections queue and the page renders slower. The attacker measures that latency to guess which branch ran.