ValueGuard: Protection of Native Applications against Data-Only Buffer Overflows. - Steven Van Acker; Nick Nikiforakis; Pieter Philippaerts; Yves Younan; Frank Piessens (ICISS, 2010)

WebJail: least-privilege integration of third-party components in web mashups. - Steven Van Acker; Philippe De Ryck; Lieven Desmet; Frank Piessens; Wouter Joosen (ACSAC, 2011)

Exposing the Lack of Privacy in File Hosting Services. - Nick Nikiforakis; Marco Balduzzi; Steven Van Acker; Wouter Joosen; Davide Balzarotti (LEET, 2011)

JSand: complete client-side sandboxing of third-party JavaScript without browser modifications. - Pieter Agten; Steven Van Acker; Yoran Brondsema; Phu H. Phung; Lieven Desmet; Frank Piessens (ACSAC, 2012)

FlashOver: automated discovery of cross-site scripting vulnerabilities in rich internet applications. - Steven Van Acker; Nick Nikiforakis; Lieven Desmet; Wouter Joosen; Frank Piessens (AsiaCCS, 2012)

You are what you include: large-scale evaluation of remote javascript inclusions. - Nick Nikiforakis; Luca Invernizzi; Alexandros Kapravelos; Steven Van Acker; Wouter Joosen; Christopher Kruegel; Frank Piessens; Giovanni Vigna (CCS, 2012)

Exploring the Ecosystem of Referrer-Anonymizing Services. - Nick Nikiforakis; Steven Van Acker; Frank Piessens; Wouter Joosen (Privacy Enhancing Technologies, 2012)

Bitsquatting: exploiting bit-flips for fun, or profit? - Nick Nikiforakis; Steven Van Acker; Wannes Meert; Lieven Desmet; Frank Piessens; Wouter Joosen (WWW, 2013)

Monkey-in-the-browser: malware and vulnerabilities in augmented browsing script markets. - Steven Van Acker; Nick Nikiforakis; Lieven Desmet; Frank Piessens; Wouter Joosen (AsiaCCS, 2014)

Password Meters and Generators on the Web: From Large-Scale Empirical Study to Getting It Right. - Steven Van Acker; Daniel Hausknecht; Wouter Joosen; Andrei Sabelfeld (CODASPY, 2015)

Isolating and Restricting Client-Side JavaScript ; Isoleren en beperken van JavaScript aan de cliëntzijde. - Steven Van Acker (2015)

Data Exfiltration in the Face of CSP. - Steven Van Acker; Daniel Hausknecht; Andrei Sabelfeld (AsiaCCS, 2016)

JavaScript Sandboxing: Isolating and Restricting Client-Side JavaScript. - Steven Van Acker; Andrei Sabelfeld (FOSAD, 2016)

Discovering Browser Extensions via Web Accessible Resources. - Alexander Sjösten; Steven Van Acker; Andrei Sabelfeld (CODASPY, 2017)

Measuring login webpage security. - Steven Van Acker; Daniel Hausknecht; Andrei Sabelfeld (SAC, 2017)

Raising the Bar: Evaluating Origin-wide Security Manifests. - Steven Van Acker; Daniel Hausknecht; Andrei Sabelfeld (ACSAC, 2018)

Latex Gloves: Protecting Browser Extensions from Probing and Revelation Attacks. - Alexander Sjösten; Steven Van Acker; Pablo Picazo-Sanchez; Andrei Sabelfeld (NDSS, 2019)