1914728 - Websites such as Amazon, Youtube are bypassing `media.autoplay.default=2`

Status: RESOLVED DUPLICATE of bug 1681603

(Core :: Audio/Video: Playback, enhancement)

Description

[2002luvabbaluvu]

Attachment: autoplay.media.default=2.png

Steps to reproduce:

Goto chrome://geckoview/content/config.xhtml,
set media.autoplay.default=2,
goto https://www.youtube.com/@Nyanners or https://www.amazon.com/gp/product/B0D4Q1HW27

Actual results:

It autoplays (the unexpected -- after autoplay is "disabled" -- flashing lights pose danger to those suffering from epilepsy.)

Expected results:

"Autoplay" is locked-down

Comment 1

[2002luvabbaluvu]

Attachment: Settings, Site permissions, Autoplay, Block.png

Have not just use about:config; used Settings to block too.

Comment 2

[2002luvabbaluvu]

Caught Amazon bypassing ( https://www.amazon.com/gp/product/B0D4Q1HW27 ) this.
Caught Youtube bypassing ( https://www.youtube.com/@Nyanners ) this.
As such bypassing can harm lots of Fenix users, have set this as a security issue ( but it is a known vulnerability on desktop Firefox; https://bugzilla.mozilla.org/show_bug.cgi?id=1681603 )

Comment 3

[Andrew McCreight [:mccr8]]

I'm not sure this is a security issue. If somebody really wants to cause your screen to blink, there are a lot more ways to do it besides a video.

Comment 4

[2002luvabbaluvu]

(In reply to Andrew McCreight [:mccr8] from comment #3)

I'm not sure this is a security issue. If somebody really wants to cause your screen to blink, there are a lot more ways to do it besides a video.

The bypassing of ` is not just an epilepsy risk.

Comment 5

[Andrew McCreight [:mccr8]]

What are the other security risks you see in bypassing this?

Comment 6

[2002luvabbaluvu]

(In reply to Andrew McCreight [:mccr8] from comment #5)

What are the other security risks you see in bypassing this?

The cybercrime described above can also be abused to cause audiogenic seizures, even if the video is not viewed; https://www.orpha.net/en/disease/detail/166415

Comment 7

[2002luvabbaluvu]

The fix for both is chrome://geckoview/content/config.xhtml -> javascript.enabled=false

Comment 8

[Daniel Veditz [:dveditz]]

This is shared "gecko" functionality; there is nothing android specific here

Comment 9

[2002luvabbaluvu]

Desktop Firefox has lots of extensions which can solve this, which Fennec Firefox can not use.

This is not solved.

The closest to a workaround is chrome://geckoview/content/config.xhtml 's media.autoplay.blocking_policy=2