1862020 - Motion sensors lacking access permission can compromise user data privacy.

Status: RESOLVED DUPLICATE of bug 1536382

(Core :: DOM: Events, defect)

Description

[horizonf88]

Attachment: poc.zip

In a standard Firefox tab on Android, it is possible for an attacker to access
motion data without obtaining the user's consent.

Motion sensor data has the potential to serve as a vector for specific types of
attacks.

In the blog below, it is evident that the motion sensor is intended to request
permission from the user

https://www.w3.org/TR/permissions/

VERSION
Firefox Nightly 121.0a1
Operating System: Android 13

REPRODUCTION CASE

1. Extract the zip
2. Host the below poc.html
3. Open Nightly, Open the below poc website
4. Click the "Request motion" button

Comment 1

[Andrew McCreight [:mccr8]]

Attachment: poc.html from the zip file

In the future, it would be easier for us to look at the bug if you attached files individually rather than in an archive.

Comment 2

[Andrew McCreight [:mccr8]]

Attachment: poc.mp4 from the zip file

Comment 3

[Andrew McCreight [:mccr8]]

I'll move this to DOM: Events for now but maybe that's not right.

Comment 4

[horizonf88]

Last time i checked there was no multiple files selecing option,so archived into a zip.

Comment 5

[Daniel Veditz [:dveditz]]

(In reply to horizonf88 from comment #4)

Last time i checked there was no multiple files selecing option,so archived into a zip.

There isn't a multi-file option, but if you zip it up it just means someone else has to attach them individually. Or the hassle of downloading and expanding the archive is enough to discourage semi-interested folks from taking a quick peak and then the bug it bottlenecked waiting for the people who will get officially assigned to it.

Comment 6

[Daniel Veditz [:dveditz]]

need to look into this