Firefox. As part of our experiments we also test Firefox. Interestingly, while the developer documentation and source code include functionality intended for favicon caching[27] similar to the other browsers, we identify inconsistencies in its actual usage. In fact, while monitoring the browser during the attack’s execution we observe that it has a valid favicon cache which creates appropriate entries for every visited page with the corresponding favicons. However, it never actually uses the cache to fetch the entries. As a result, Firefox actually issues requests to re-fetch favicons that are already present in the cache. We have reported this bug to the Mozilla team, who verified and acknowledged it. At the time of submission, this remains an open issue. Nonetheless, we believe that once this bug is fixed our attack will work in Firefox, unless they also deploy countermeasures to mitigate our attack (we provide more details on our attack’s disclosure in §VII).