Bug 1330278 (CVE-2016-2813) - CVE-2016-2813 Mozilla: Disclosure of user actions through JavaScript with motion and orientation sensors (MFSA 2016-43)
Summary: CVE-2016-2813 Mozilla: Disclosure of user actions through JavaScript with mot...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2016-2813
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1306172
TreeView+ depends on / blocked
 
Reported: 2016-04-25 18:55 UTC by Siddharth Sharma
Modified: 2021-02-17 03:58 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-04-06 03:45:07 UTC
Embargoed:


Attachments (Terms of Use)

Description Siddharth Sharma 2016-04-25 18:55:43 UTC
Security researcher Maryam Mehrnezhad of Newcastle University, UK reported an issue discovered by their research team, which also includes Ehsan Toreini, Siamak F. Shahandashti, and Feng Hao. They found vulnerabilities in Firefox for Android using orientation data and motion sensors on a mobile device's browser accessible through JavaScript. This allows an attacker to infer touch actions on the device through these sensors when orientation events are triggered in the browser, compromising user privacy and including potentially revealing entered PIN code data along with other user activities.

This issue does not affect desktop versions of Firefox.

External Reference:

https://www.mozilla.org/security/announce/2016/mfsa2016-43.html

Comment 1 Siddharth Sharma 2016-04-25 18:55:50 UTC
Acknowledgments:

Name: the Mozilla project
Upstream: Maryam Mehrnezhad


Note You need to log in before you can comment on or make changes to this bug.