1719511 - (CVE-2022-38474) No recording notification for microphone

Status: RESOLVED FIXED

(Fenix :: General, defect)

Description

[[ex-Mozilla] Agi Sferro | :agi]

Navigate to a page that records audio, e.g.: https://addpipe.com/simple-web-audio-recorder-demo/

Start recording, notice no notification appears that the page is recording audio.

Chrome shows a notification as expected.

Comment 1

[[ex-Mozilla] Agi Sferro | :agi]

This might be related to the recent deprecation of the onRecordingStatusChanged API

Comment 2

[[ex-Mozilla] Agi Sferro | :agi]

I can reproduce in release so this is not a recent regression :(

Comment 3

[Daniel Veditz [:dveditz]]

Since this can only apply to sites you've given permission to there won't be too many opportunities for maliciousness, but people might forget that it's running. (Recording without permission would be sec-high, even if there is a tiny recording icon somewhere)

Comment 4

[[ex-Mozilla] Agi Sferro | :agi]

It looks like all it's needed here is for AC/Fenix to listen for onRecordingStatusChanged and display a notification.

Comment 5

[Arturo Mejia [:amejia]]

Attachment: 0001-Improve-the-media-delegate.patch

[Security approval request comment]
How easily could an exploit be constructed based on the patch?
Not easy.

Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?
No.

Which older supported branches are affected by this flaw?
102 (Actual)

If not all supported branches, which bug introduced the flaw?
Not know.

Do you have backports for the affected branches? If not, how different, hard to create, and risky will they be?
No.

How likely is this patch to cause regressions; how much testing does it need?
Not likely.

Comment 6

[Arturo Mejia [:amejia]]

We landed a patch on AC and manually verified that the notification is working as expected. The fix should be in Fenix and Focus as soon ad they get the new AC update.

Comment 7

[Tom Ritter [:tjr]]

Attachment: advisory.txt