Disclosure of user actions through JavaScript with motion and orientation sensors

2016-04-26T00:00:00
ID MFSA2016-43
Type mozilla
Reporter Mozilla Foundation
Modified 2016-04-26T00:00:00

Description

Security researcher Maryam Mehrnezhad of Newcastle University, UK reported an issue discovered by their research team, which also includes Ehsan Toreini, Siamak F. Shahandashti, and Feng Hao. They found vulnerabilities in Firefox for Android using orientation data and motion sensors on a mobile device's browser accessible through JavaScript. This allows an attacker to infer touch actions on the device through these sensors when orientation events are triggered in the browser, compromising user privacy and including potentially revealing entered PIN code data along with other user activities.

This issue does not affect desktop versions of Firefox.