I Stored a Website in a Favicon

You can use the favicon cache as storage too, by redirecting users across domains. It's been proposed as a potential fingerprinting risk[0], and if a browser naively reuses the cache for incognito mode, it could be used to track users across browser profiles.

[0]: https://www.schneier.com/blog/archives/2021/02/browser-track...

Re: I Stored a Website in a Favicon

#6

Post by schobi » Sat, Jun 20, 2026, 6:26 AM UTC

superjose wrote: post #3

Pretty cool tbh!!! Would have loved seeing the decoder code!!! It's also pretty interesting to think how an attacker could exploit images on his behalf. Never thought that would be a way!!! Thanks!

I guess the decoder is more than the 208 bytes that this page uses..

But maybe you can misuse this and store a session ID / cookie in a favicon (give everyone a unique one) and survive some cookie cleanup and evade privacy restrictions?

Maybe you can still make it that the favicon looks like an image a little to not raise suspicion?

Favicons seem to be cached across private browsing sessions. Oh no

Re: I Stored a Website in a Favicon

#7

Post by Tepix » Sat, Jun 20, 2026, 6:30 AM UTC

Instead of going via pixels, why not use a SVG favicon and directly store markup inside it and extract it?

Use this favicon.svg:

    
    
    hello HN!

use this in your to use a svg favicon:

finally, use this in your to extract it and add it to your document body:

    
    fetch(favicon.href).then(r => r.text()).then(t => document.body.innerHTML += t.match(//)[0]);

Re: I Stored a Website in a Favicon

#8

Post by bozdemir » Sat, Jun 20, 2026, 6:30 AM UTC

Very cool. I wonder is it possible to make a simple game with also leveraging the webassembly?

Re: I Stored a Website in a Favicon

#9

Post by Walf » Sat, Jun 20, 2026, 6:44 AM UTC

PNG has comment chunks tEXt, zTXt, and iTXt. You can have a completely normal image whose file is stuffed with as much content as you want. That is less fun, I suppose.

Re: I Stored a Website in a Favicon

#10

Post by koolala » Sat, Jun 20, 2026, 6:44 AM UTC

sheept wrote: post #5

You can use the favicon cache as storage too, by redirecting users across domains. It's been proposed as a potential fingerprinting risk[0], and if a browser naively reuses the cache for incognito mode, it could be used to track users across browser profiles. [0]: https://www.schneier.com/blog/archives/2021/02/browser-track...

Wasn't this fixed or mostly fixed?