Loading HuntDB...

languagechange event fires simultaneously on all tabs

Low
T
Tor
Submitted None
Reported by tomvg

Vulnerability Details

Technical details and impact analysis

Privacy Violation
The `languagechange` event, which fires when the user modifies the browser's language settings fires simultaneously on all tabs. This would allow an adversary to link multiple visits to a single user: the adversary (e.g. a malicious ad provider) has a script that listens for this event, and when fired sends a signal to the adversary's server which includes the timestamp of the event. Since this is an event that does not occur very often (only when the user changes the browser's language), so the chances that this event occurs at the exact same millisecond on with multiple users is very small. I believe this has been a small oversight, since the `online` and `offline` events do seem to be disabled because of this threat. ### PoC As a proof-of-concept, you can open http://192.31.23.250/_events/get-event-values.html and https://poc.tom.vg/events-session-associate/get-event-values.html in different tabs (these are from different origins), select `onlanguagechange` from the dropdown and press the "Start" button. Next, change the language of the browser in the "Content" tab of the preferences (`about:preferences#content`): just add/remove one of change the order. Afterwards you should see an event logged on both tabs with approximately the same timestamp (the value might slightly differ because of the timer resolution).

Report Details

Additional information and metadata

State

Closed

Substate

Resolved

Bounty

$100.00

Submitted

Weakness

Privacy Violation