Mind the Gap: Characterizing the Temporal Blind Spot Between GSB and DNS Resolution

Jul 16, 2026

Upload by Rowan

Google Safe Browsing (GSB) and DNS resolution run concurrently during browser navigation, yet their packet-level timing synchronization has been largely unexplored. This work measures the time gap between GSB-related query close events and the arrival of final DNS responses, reporting a consistent temporal offset with security implications. Packet-capture analysis across general and CNAME-domain datasets shows positive gaps in about 79% of measurements, with median delays of 67–79 ms and maxima above 2,400 ms. The study suggests CNAME-induced inconsistencies may create a timing precondition under DNS-manipulation threat models and motivates further timing-risk research.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages6

Reading Time15 min

Abstract

Introduction

Background

Threat Model and Security Relevance

Methodology

Metric and Extraction

Data Selection

arXiv :2607 .06 134v 1 [ cs .CR] 7 Jul 2026 Poster: Mind the Gap-Characterizing the Temporal Blind Spot Between GSB and DNS Resolution Tomer Gal 1 , Fujiao Ji2 , Doowon Kim2 , and Harel Israel Berger 1 1 Ariel University [harelb@ariel.ac.il](harelb@ariel.ac.il) ,[tomergal40@gmail.com](tomergal40@gmail.com) 2 University of Tennessee, Knoxville [fji1@vols.utk.edu](fji1@vols.utk.edu) ,[dkim52@utk.edu](dkim52@utk.edu) Abstract. Google Safe Browsing (GSB) and DNS resolution operate concurrently during browser navigation, yet their packet-level synchronization remains understudied. This work characterizes the timing gap (∆time ) between GSB-related query close events and parallel DNS resolution responses, identifying a consistent temporal offset with potential security relevance. Using packet-capture analysis across general and CNAME-domain datasets, we observe positive timing gaps in approximately 79% of measurements. In these instances, DNS responses lag behind GSB-related query closures with median delays of 67–79 ms and maximum delays surpassing 2,400 ms. These empirical results highlight a measurable window within the browsing workflow. We suggest that such temporal inconsistencies, particularly in complex CNAME-domain resolutions, may create a security-relevant timing precondition under DNSmanipulation threat models. These results provide a foundation for further research into timing-based risks and mitigations in browser safety mechanisms. Keywords: Google Safe Browsing · DNS · CNAME · Packet Measurement 1 Introduction Modern web navigation relies on the parallel execution of browser-level safety checks and DNS address resolution. While Google Safe Browsing (GSB) 3 helps identify potentially malicious resources, DNS maps domains to network destinations. This workflow becomes more complex when domains resolve through Canonical Name (CNAME) chains, which may require multiple DNS steps before the final address is obtained. Although both GSB [2,3,4,7,9] and DNS [1,6,10] have been studied as independent attack surfaces, their packet-level synchronization within the browser workflow remains underexplored. This work examines whether GSB-related query 3 [https://safebrowsing.google.com/](https://safebrowsing.google.com/) 2 Tomer Gal, Fujiao Ji , Doowon Kim, and Harel Israel Berger close events and final DNS responses exhibit a measurable temporal gap with potential security relevance, particularly for CNAME-based resolutions. We evaluate this relationship using general-domain and CNAME-domain datasets. Positive timing gaps appear in approximately 78%–80% of measured samples, with median delays around 70 ms and maximum observed delays exceeding two seconds. Our study makes the following contributions: 1. We define a packet-level timing metric for comparing GSB-related query close events and final DNS response events. 2. We measure this relationship across general-domain and CNAME-domain datasets. 3. We quantify the prevalence and magnitude of positive timing gaps across the measured datasets. 2 Background 2.1 Google Safe Browsing and DNS Resolution Google Safe Browsing (GSB) helps identify potentially unsafe web resources during browser navigation. To balance performance and privacy, browsers typically check a local hash-prefix database and query GSB servers only when a prefix match occurs. This work does not evaluate GSB’s detection accuracy; rather, it studies the packet-level timing of GSB-related connection events relative to DNS resolution. DNS translates domain names into network-level addresses. While a standard lookup may directly return an A or AAAA record, modern web infrastructure often uses Canonical Name (CNAME) records, where one domain aliases another before a final address is obtained. Such multi-step resolution can introduce additional latency, motivating our comparison between general-domain and CNAME-domain measurements. 2.2 Threat Model and Security Relevance The se

FAQs

What timing relationship does the study focus on between GSB and DNS?

It characterizes the temporal gap between GSB-related connection/query close events and the arrival time of the final DNS response, defined as Δtime = Tresolution − Tquery_close.

What did the packet measurements show about the frequency and size of the timing gap?

Positive timing gaps were observed in roughly 78%–80% of samples, with median delays around 67–79 ms and maximum delays exceeding 2,400 ms.

Why are CNAME-domain resolutions considered security-relevant in this work?

The paper argues that concurrent GSB checks and multi-step CNAME resolution can allow the browser’s safety decision to be made before the final network endpoint is fully established, creating a timing precondition under DNS-manipulation threat models.

Jul 16, 2026

Upload by Rowan