| 2017 | ESORICS | DOMPurify: Client-Side Protection Against XSS and Markup Injection. | Mario Heiderich, Christopher Spth, Jrg Schwenk |
| 2015 | CCS | How Private is Your Private Cloud?: Security Analysis of Cloud Control Interfaces. | Dennis Felsch, Mario Heiderich, Frederic Schulz, Jrg Schwenk |
| 2015 | ESORICS | Waiting for CSP - Securing Legacy Web Applications with JSAgents. | Mario Heiderich, Marcus Niemietz, Jrg Schwenk |
| 2014 | DSN | Scriptless Timing Attacks on Web Browser Privacy. | Bin Liang, Wei You, Liangkun Liu, Wenchang Shi, Mario Heiderich |
| 2013 | CCS | mXSS attacks: attacking well-secured web-applications by using innerHTML mutations. | Mario Heiderich, Jrg Schwenk, Tilman Frosch, Jonas Magazinius, Edward Z. Yang |
| 2012 | CCS | Scriptless attacks: stealing the pie without touching the sill. | Mario Heiderich, Marcus Niemietz, Felix Schuster, Thorsten Holz, Jrg Schwenk |
| 2011 | CCS | Crouching tiger - hidden payload: security risks of scalable vectors graphics. | Mario Heiderich, Tilman Frosch, Meiko Jensen, Thorsten Holz |
| 2011 | CCS | All your clouds are belong to us: security analysis of cloud management interfaces. | Juraj Somorovsky, Mario Heiderich, Meiko Jensen, Jrg Schwenk, Nils Gruschka, Luigi Lo Iacono |
| 2011 | RAID | IceShield: Detection and Mitigation of Malicious Websites with a Frozen DOM. | Mario Heiderich, Tilman Frosch, Thorsten Holz |