1941847 - Gecko reveals more GPU Hardware Information than Webkit/chromium

Status: RESOLVED DUPLICATE of bug 1916271

(Core :: Graphics: CanvasWebGL, defect)

Description

[Shaheen Fazim]

Attachment: gpu-leak.html

Using the proof of concept below, the Firefox browser may unintentionally leak a user's GPU information when visiting a site.

Steps to reproduce:

1. Download gpu-leak.html.
2. Visit the gpu-leak.html page on the latest Firefox browser.
3. Observe that the user's GPU information is displayed on the visited site.

Comment 1

[Shaheen Fazim]

Attachment: poc.png

Comment 2

[Andrew McCreight [:mccr8]]

Looks like these are canvas WebGL parameters. Tom, maybe this is a known issue?

Comment 3

[Tom Ritter [:tjr] (OOTO until April)]

We mask the renderer string, the details provided do not actually correspond directly to the user's hardware they are merely indicative. Therefore this bug is INVALID. However I am curious about Chrome's behavior and not reporting any information at all...

Comment 4

[Tom Ritter [:tjr] (OOTO until April)]

Specifically the code is here: https://searchfox.org/mozilla-central/source/dom/canvas/SanitizeRenderer.cpp#27

Comment 5

[Fatih Kilic [:fkilic]]

We sanitize while they hardcode it completely GL_RENDERER and GL_VENDOR from blink

Comment 7

[Fatih Kilic [:fkilic]]

I also want to note that we also spoof unmasked values too. For example running the following code

const canvas = document.createElement("canvas");
const gl = canvas.getContext("webgl");

const debugInfo = gl.getExtension("WEBGL_debug_renderer_info");
const vendor = gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL);
const renderer = gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL);

console.log(vendor);
console.log(renderer);

Produces the following on Firefox

> Apple
> Apple M1, or similar

Produces the following on Chrome

> Google Inc. (Apple)
> ANGLE (Apple, ANGLE Metal Renderer: Apple M3 Pro, Unspecified Version)