New issue
Advanced search Search tips

Issue 643347 link

Starred by 3 users

Issue metadata

Status: Assigned
Owner:
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

Gamepad appears to be readable from multiple background tabs simultaneously

Reported by just...@gmail.com, Sep 1 2016

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36

Steps to reproduce the problem:
1. html5gamepad.com
2. press a button, it should show your Gamepad
3. open another tab and html5gamepad.com
4. press a button, it should show your Gamepad
5. Go back to original tab, note that the timestamps updated

What is the expected behavior?
I expect that the background tab did not receive updated Gamepad data as the tab wasn't focused/active.

What went wrong?
I don't expect two tabs to be able to get my Gamepad input simultaneously. Other browsers, namely Edge, restrict access to the Gamepad to the active tab. I have not yet tested iframe scenarios within the same tab, but it would seem that might be broken as well.

With WebVR our primary input model is a Gamepad so making sure that the input of the Gamepad is secure will be important to establishing a user trust model.

Did this work before? No 

Chrome version: 52.0.2743.116  Channel: n/a
OS Version: 10.0
Flash Version: Shockwave Flash 22.0 r0

I recall looking at this in Edge/IE years ago and I'm pretty sure at that time, the same bug existed in Chrome and Edge/IE decided to take a more restrictive approach.
 
Components: IO>Gamepad

Comment 2 by vakh@chromium.org, Sep 1 2016

Labels: Security_Impact-Head Security_Severity-Low
Owner: bajones@chromium.org
Status: Assigned (was: Unconfirmed)

Comment 3 by mea...@chromium.org, Apr 21 2017

Components: Privacy
bajones: Ping. Is it expected that background tabs can get gamepad inputs? 
Labels: -Security_Impact-Head Security_Impact-Stable M-52
Components: Blink>GamepadAPI
Cc: mbarbe...@chromium.org mattreynolds@chromium.org
bajones, mattreynolds: Any answer to the question in c#3?
Project Member

Comment 7 by sheriffbot@chromium.org, Feb 15 2018

Labels: -M-52 M-64
Yes, this is expected. Gamepad inputs don't follow the focus model and are polled rather than event-based. All visible tabs can receive gamepad input even if they lack focus. This is fairly normal for gaming applications where it is sometimes desirable for an unfocused window to receive gamepad inputs.

I think a truly backgrounded tab will not receive gamepad inputs, but will receive the most up-to-date gamepad state once the tab is foregrounded. This could explain why you are seeing the timestamp update for a backgrounded tab.
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam -Security_Severity-Low -Security_Impact-Stable Type-Bug
Thanks for the update. Based on that I think it's reasonable to remove this from the security queue. If there's no additional work planned feel free to close the bug.

Sign in to add a comment