IMDEA Networks research receives 2026 USENIX Internet Defense Prize and Distinguished Paper Award

The paper “Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost” was recognized for its scientific contribution and practical impact on strengthening Internet security following its responsible disclosure

31 August 2026

An international research collaboration co-led by IMDEA Networks received the 2026 USENIX Internet Defense Prize and the 2026 USENIX Security Distinguished Paper Award for its paper “Bridges to Self: Silent Web-to-App Tracking on Mobile via Localhost”. The awards were presented during the 34th USENIX Security Symposium, one of the most prestigious conferences in cybersecurity research, recognizing both the paper’s scientific contribution and its practical impact on Internet security.

The award-winning paper uncovered a previously unknown web-to-app tracking technique that exploited localhost connections to silently link users’ web browsing activity with persistent identities in native Android apps. In this way, and without their knowledge or consent, unvetted local communication channels could connect browsers with native apps installed on the same device and enable cross-platform tracking.

Following the researchers’ responsible disclosure, major Android browsers and the Android operating system introduced mitigations to prevent this type of abuse. The work also triggered several class actions in the USA, Canada and Germany, informed discussions among web standard bodies, data protection authorities, and policymakers in Europe and the United States, including presentations to the Spanish Congress and an open letter from members of the U.S. Congress to Mark Zuckerberg inquiring about the discovery.

Earlier this year, the paper received the 2026 CNIL–Inria Privacy Award, recognizing its contribution to advancing privacy protection and its broader societal impact. This recognition underscores the value of collaborative research that combines scientific excellence with responsible disclosure and close engagement with browser vendors, standards bodies, and regulators to translate research findings into tangible improvements for Internet users.

“Receiving the USENIX Internet Defense Prize, together with the USENIX Distinguished Paper Award, is an extraordinary recognition of both the scientific excellence of this work and its real-world impact. Receiving this recognition at USENIX Security, one of the world’s most prestigious and highly regarded academic conferences in cybersecurity, is particularly meaningful and reflects the kind of ambitious, fundamental research we strive to pursue at IMDEA Networks. IMDEA’s academic freedom and long-term research vision allow us to independently investigate difficult questions, including problems with important societal implications, and ultimately to translate fundamental research into knowledge that helps safeguard users and contributes to a safer and more trustworthy digital society. This recognition also speaks to the exceptional research environment and collaborative culture that make this kind of work possible”, says Narseo Vallina, Research Associate Professor at IMDEA Networks and coauthor of the paper.

The USENIX Internet Defense Prize included a USD 25,000 cash award, which was shared among the three participating institutions (IMDEA Networks, Radboud University and KU Leuven) to support further research building on the project’s findings.

“The key lesson is that privacy threats often hide in assumptions we have stopped questioning. Localhost was considered safe almost by definition because it is confined to the user’s own device. But even when browsers, apps and operating systems each enforce strong protections, gaps can emerge in how they interact. The security community should keep questioning these boundaries and testing whether long-standing assumptions still hold.”, concludes Aniketh Girish, Post-Doc researcher at IMDEA Networks and co-author of the work.