1414937 - (CVE-2024-5697) Websites should not be able to detect that someone is taking a screenshot of them

Status: RESOLVED FIXED

(Firefox :: Screenshots, defect, P2)

Description

[Wil Clouser [:clouserw]]

It's currently possible to detect the frame we're injecting.  It shouldn't be possible to detect someone taking a screenshot.

I'm not going to file a separate bug because it's probably a subset, but "A website should not be able to interfere with someone taking a screenshot" is a part of this bug also, and if it's a different technical solution we should file that bug separately.

Comment 1

[Ian Bicking (:ianbicking)]

Shane has been experimenting with an overlay API: https://github.com/mixedpuppy/layers – it's just an experiment, not something that's gone through design or prioritization.

Comment 2

[Shane Caraveo (:mixedpuppy)]

TBH, I'm not really sure this should depend on bug 1340930 being implemented, it's not clear that we will.

Comment 4

[Daniel Veditz [:dveditz]]

Note also, from dupe 1753823, that detecting the screenshot elements also allows grabbing the unique moz-extension:// guid, allowing the user to be exactly identified in the future. That's already known as a general issue from injected Web Extension content, and affects some extensions much worse (this one only allows users to be tracked when they take screenshots, but most people don't do that all the time).

Comment 5

[Sam Foster [:sfoster] (he/him)]

Fixed in nightly with the pref flipped in bug 1870127 to make the new implementation the default. We now avoid injecting the iframe and use the anonymous content document to host the overlay UI.

Comment 6

[Tom Ritter [:tjr]]

Attachment: advisory.txt