Bug 1330278 (CVE-2016-2813) - CVE-2016-2813 Mozilla: Disclosure of user actions through JavaScript with motion and orientation sensors (MFSA 2016-43)
Summary: CVE-2016-2813 Mozilla: Disclosure of user actions through JavaScript with mot...
Alias: CVE-2016-2813
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On:
Blocks: 1306172
TreeView+ depends on / blocked
Reported: 2016-04-25 18:55 UTC by Siddharth Sharma
Modified: 2019-09-29 13:48 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2017-04-06 03:45:07 UTC

Attachments (Terms of Use)

Description Siddharth Sharma 2016-04-25 18:55:43 UTC
Security researcher Maryam Mehrnezhad of Newcastle University, UK reported an issue discovered by their research team, which also includes Ehsan Toreini, Siamak F. Shahandashti, and Feng Hao. They found vulnerabilities in Firefox for Android using orientation data and motion sensors on a mobile device's browser accessible through JavaScript. This allows an attacker to infer touch actions on the device through these sensors when orientation events are triggered in the browser, compromising user privacy and including potentially revealing entered PIN code data along with other user activities.

This issue does not affect desktop versions of Firefox.

External Reference:


Comment 1 Siddharth Sharma 2016-04-25 18:55:50 UTC

Name: the Mozilla project
Upstream: Maryam Mehrnezhad

Note You need to log in before you can comment on or make changes to this bug.