# Case Study I - Browser Anomaly with Facebook Apps -1500$

Chrome attributed iframe permission prompts to apps.facebook.com instead of the embedded game origin, letting any Facebook app silently capture camera/mic from users who had granted permission to another app.

- Payout: $1,500
- Severity: high
- Program: Meta / Facebook
- Credited: easySIEM
- Disclosed: 2020-07-05
- Write-up quality: 6/10
- Original: https://blog.easysiem.com/application-security/case-study-i-browser-anomaly-with-facebook-apps-1500usd
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-easysiem-com-application-security-case-study-i-browser-anomaly-with-facebook-apps-1500usd
- Tags: domain:browser domain:web impact:data-leak impact:privesc kind:bounty platform:blog sev:high tech:chromium technique:recon vuln:access-control vuln:misconfiguration

**Target:** apps.facebook.com embedded game iframe (getUserMedia permissions)
**Root cause:** Chrome's permission prompt for sandboxed cross-origin iframes on apps.facebook.com showed the top-level origin (apps.facebook.com) rather than the embedded game URL, so a grant made for one app applied to all apps on that origin.
**Steps:**
1. Host attacker HTML at https://ATTACKER-GAME-URL-EMBED.com/ that calls `navigator.mediaDevices.getUserMedia({video:true})` and pipes the stream into a `<video>` element.
2. Register a Facebook Web Game app pointing its web URL to the attacker host.
3. Victim first grants camera/mic to apps.facebook.com via a legitimate app (e.g. a video call at apps.facebook.com/videocall/...).
4. Victim visits apps.facebook.com/ATTACKER_APP; in Chrome no new prompt appears and the attacker's getUserMedia resolves with the victim's camera/mic stream.
5. Compare with Firefox, which prompts with the embedded origin https://ATTACKER-GAME-URL-EMBED.com/ and thus isolates the grant.
**How found:** Studying sandboxed iframe behavior and browser permission handling (media, geolocation, payment, VR) led to the Chromium doc on deprecating permissions in cross-origin iframes; testing the same embed in Firefox vs Chrome revealed the origin shown in the prompt differed.
**Exploitation:** Attacker registers a Facebook Web Game, embeds getUserMedia code, and waits for any user who previously granted camera/mic to apps.facebook.com (e.g. via a video-call app) to load the malicious app; the stream is captured without a fresh prompt.
**Insight:** When a platform hosts third-party code in iframes on a shared origin, test whether the browser's permission prompt binds to the top-level origin rather than the embedded origin — a single prior grant then becomes a cross-tenant capability leak.