Here's How Web Browsers On Android Share Every Move You Make On The Web

When you open an app or website, location or GPS permissions are one of those things people tend not to allow. However, what if the app or site was able to extrapolate where you are without even needing new permissions? This is potentially happening on your Android device as security researchers have shown that motion sensor permissions are enabled by default for some browsers on Android, allowing for some quite concerning data collection.

Late last month, researchers at Mysk tweeted a message to Android users explaining that Chrome, by default, shares motion sensor data with all the websites users visit. Moreover, it appears the Microsoft Edge on Android has the same permission set. While this may not seem like a big deal at first glance, there are some alarming implications here.

Dear #Android users,
Chrome shares your motion sensor with all the websites you visit by default.
This video shows how you can disable it. Please do it now.
You can learn more about this here:https://t.co/zMbPpuX3VH#CyberSecurity #Privacy pic.twitter.com/riWNQUfxKB

— Mysk 🇨🇦🇩🇪 (@mysk_co) October 29, 2021

The Mysk blog linked in the tweet explains that sensors such as the accelerometer are normally used for device orientation, among other uses, such as a pedometer, speed detector, and more. However, this sensor can also be used more nefariously to figure out your precise location if desired. In one such scenario, a person sit down on a bus and looks at their favorite social app that lacks location permissions. When the bus stops, a person boards the bus and opens the same app with their location shared. The app can then use the accelerometer to figure out that the vibration patterns of both devices are the same and thus must be in the same location.


To ensure this is not an issue, users can follow Mysk’s video for disabling motion sensor permissions in Chrome. For those of us who use Edge on Android, the process is quite similar as you can see in our image above. In any event, it is unclear why this was on by default, but hopefully, there will be an update to fix this shortly.