1598954 - Phone's physical front camera pops up when watching YouTube videos.

Status: RESOLVED DUPLICATE of bug 1578073

(Core :: WebRTC: Audio/Video, defect)

Description

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

From https://twitter.com/ishatyagi3/status/1198511113840680961

"Front camera pops up Everytime I open http://YouTube.com in Firefox for Android. #privacyCompromised #vulnerability"

This is on a device where a physical camera extrudes from the handset on demand. The posted twitter video shows it popping out when merely viewing a YouTube video.

Comment 1

[Isha Tyagi]

@Jan-Ivar : Thanks for reporting this here.
This happens when Mozilla is granted camera permissions.

Comment 2

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

(In reply to Isha Tyagi from comment #1)

@Jan-Ivar : Thanks for reporting this here.

Thanks for discovering this! Just to record info here: The phone appears to be a OnePlus 7 PRO (Android 10) with OnePlus's OxygenOS.

This happens when Mozilla is granted camera permissions.

That should only happen if a web site asks for camera or microphone (AND YOU ALLOW IT), which I doubt YouTube is doing when merely watching a video. I didn't see an Android OS permission prompt in your video, nor a Firefox user permission prompt, and this shouldn't happen just watching YouTube videos of course.

From the modern Firefox logo, I'm guessing this is Firefox for Android 68.1.1? - I ask because we fixed a bug in this area relating to enumerateDevices() in 66 (bug 1450762) that this reminded me of. James, you worked on that one. Any thoughts on this one?

A follow-up tweet suggests the bug might be in our code relating to how we request Android OS permissions for things (camera pops up when allowing unrelated "storage" OS permission).

Comment 3

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Isha, thanks for verifying version is 68.2.1.

We don't know the cause yet, but evidence so far I think suggests this is an issue negotiating app permissions between Android OS and the Firefox app. Rest assured I see no indication camera or microphone information is being shared with the web site (YouTube in this case), which is good! Firefox for Android does not allow users to give sites persistent camera or microphone permission (meaning it asks the user every time).

James, I have verified YouTube does call enumerateDevices() FWIW (on desktop, but I assume it's the same situation on Android). They may have legitimate reasons for doing this, such as whether to show an upload button or some such.

Comment 4

[Isha Tyagi]

I can confirm that camera permission was granted before , during my instagram interactions in the browser.

Comment 5

[Alex Chronopoulos [:achronop]]

Similar reports have been made for other pages containing videos in Bug 1578073. It was verified that the enumerateDevices() was not the culprit.

Comment 6

[Jan-Ivar Bruaroey [:jib] (needinfo? me)]

Let's track this in bug 1578073.