Crouching tiger - hidden payload: security risks of scalable vectors graphics. - Mario Heiderich; Tilman Frosch; Meiko Jensen; Thorsten Holz (CCS, 2011)

All your clouds are belong to us: security analysis of cloud management interfaces. - Juraj Somorovsky; Mario Heiderich; Meiko Jensen; Jörg Schwenk; Nils Gruschka; Luigi Lo Iacono (CCSW, 2011)

IceShield: Detection and Mitigation of Malicious Websites with a Frozen DOM. - Mario Heiderich; Tilman Frosch; Thorsten Holz (RAID, 2011)

The Bug That Made Me President a Browser- and Web-Security Case Study on Helios Voting. - Mario Heiderich; Tilman Frosch; Marcus Niemietz; Jörg Schwenk (VoteID, 2011)

Scriptless attacks: stealing the pie without touching the sill. - Mario Heiderich; Marcus Niemietz; Felix Schuster; Thorsten Holz; Jörg Schwenk (CCS, 2012)

On the Fragility and Limitations of Current Browser-Provided Clickjacking Protection Schemes. - Sebastian Lekies; Mario Heiderich (WOOT, 2012)

XSS-FP: Browser Fingerprinting using HTML Parser Quirks - Erwan Abgrall; Yves Le Traon; Martin Monperrus; Sylvain Gombault; Mario Heiderich; Alain Ribault (CoRR, 2012)

Towards elimination of XSS attacks with a trusted and capability controlled DOM - Mario Heiderich (2012)

mXSS attacks: attacking well-secured web-applications by using innerHTML mutations. - Mario Heiderich; Jörg Schwenk; Tilman Frosch; Jonas Magazinius; Edward Z. Yang (CCS, 2013)

Scriptless Timing Attacks on Web Browser Privacy. - Bin Liang 002; Wei You 001; Liangkun Liu; Wenchang Shi; Mario Heiderich (DSN, 2014)

Scriptless attacks: Stealing more pie without touching the sill. - Mario Heiderich; Marcus Niemietz; Felix Schuster; Thorsten Holz; Jörg Schwenk (J. Comput. Secur., 2014)

How Private is Your Private Cloud?: Security Analysis of Cloud Control Interfaces. - Dennis Felsch; Mario Heiderich; Frederic Schulz; Jörg Schwenk (CCSW, 2015)

Waiting for CSP - Securing Legacy Web Applications with JSAgents. - Mario Heiderich; Marcus Niemietz; Jörg Schwenk (ESORICS (1), 2015)

DOMPurify: Client-Side Protection Against XSS and Markup Injection. - Mario Heiderich; Christopher Späth; Jörg Schwenk (ESORICS (2), 2017)