Mozilla Foundation Security Advisory 2016-43
Disclosure of user actions through JavaScript with motion and orientation sensors
- Announced
- April 26, 2016
- Reporter
- Maryam Mehrnezhad
- Impact
- High
- Products
- Firefox
- Fixed in
-
- Firefox 46
Description
Security researcher Maryam Mehrnezhad of Newcastle University, UK reported an issue discovered by their research team, which also includes Ehsan Toreini, Siamak F. Shahandashti, and Feng Hao. They found vulnerabilities in Firefox for Android using orientation data and motion sensors on a mobile device's browser accessible through JavaScript. This allows an attacker to infer touch actions on the device through these sensors when orientation events are triggered in the browser, compromising user privacy and including potentially revealing entered PIN code data along with other user activities.
This issue does not affect desktop versions of Firefox.