Vulnerability Details:
Please provide a brief explanation of the security issue.
Using the MediaElement captureStream on crossOrigin resources should throw a security error, it currently doesn't. This means that the security measures placed on other APIs (e.g WebAudio or Canvas) can be defeated.


What steps will reproduce the problem?
(1) load a cross-origin media in 'media_elt1'
(2) set media1.captureStream resulting MediaStream as the source of 'media_elt2'
(3) draw 'media_elt2' on a canvas and call its `toDataURL` method


Please any provide additional information:

https://jsfiddle.net/w77z6w90/
 

Deleted: chrome bug.html 874 bytes

chrome bug.html 874 bytes View Download