The Web’s Sixth Sense - A Study of Scripts Accessing Smartphone Sensors

Aug 27, 2026

Uploaded by Rowan

A large-scale measurement study examines how smartphone sensor APIs are used on the mobile web and how stateless tracking is performed. The research extends OpenWPM into OpenWPMMobile, enabling plausible sensor emulation for motion, orientation, proximity, and light. Sensor APIs are accessed on thousands of top websites by scripts from many domains, alongside mobile fingerprinting attempts. The study finds sensor misuse often overlaps with fingerprinting and that exfiltrated readings are sent for remote analysis. It evaluates countermeasures and finds common protections and even privacy-focused browsers often fail to implement W3C mitigations.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages18

Reading Time45 min

AccessFree to download

Abstract

Introduction

Sensor APIs and emerging web applications

Security and privacy risks of sensor access

Research questions and study goals

The Web’s Sixth Sense: A Study of Scripts Accessing Smartphone Sensors Anupam Das North Carolina State University [anupam.das@ncsu.edu](anupam.das@ncsu.edu) Gunes Acar Princeton University [gunes@princeton.edu](gunes@princeton.edu) Nikita Borisov University of Illinois at Urbana-Champaign [nikita@illinois.edu](nikita@illinois.edu) ABSTRACT We present the first large-scale measurement of smartphone sensor API usage and stateless tracking on the mobile web. We extend the OpenWPM web privacy measurement tool to develop OpenWPMMobile, adding the ability to emulate plausible sensor values for different smartphone sensors such as motion, orientation, proximity and light. Using OpenWPM-Mobile we find that one or more sensor APIs are accessed on 3 695 of the top 100K websites by scripts originating from 603 distinct domains. We also detect fingerprinting attempts on mobile platforms, using techniques previously applied in the desktop setting. We find significant overlap between fingerprinting scripts and scripts accessing sensor data. For example, 63% of the scripts that access motion sensors also engage in browser fingerprinting. To better understand the real-world uses of sensor APIs, we cluster JavaScript programs that access device sensors and then perform automated code comparison and manual analysis. We find a significant disparity between the actual and intended use cases of device sensor as drafted by W3C. While some scripts access sensor data to enhance user experience, such as orientation detection and gesture recognition, tracking and analytics are the most common use cases among the scripts we analyzed. We automated the detection of sensor data exfiltration and observed that the raw readings are frequently sent to remote servers for further analysis. Finally, we evaluate available countermeasures against the misuse of sensor APIs. We find that popular tracking protection lists such as EasyList and Disconnect commonly fail to block most tracking scripts that misuse sensors. Studying nine popular mobile browsers we find that even privacy-focused browsers, such as Brave and Firefox Focus, fail to implement mitigations suggested by W3C, which includes limiting sensor access from insecure contexts and cross-origin iframes. We have reported these issues to the browser vendors. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org). CCS’18, October 15–19, 2018, Toronto, ON, Canada © 2018 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 978-1-4503-5693-0/18/10. . . $15.00 [https://doi.org/10.1145/3243734.3243860](https://doi.org/10.1145/3243734.3243860) Amogh Pradeep Northeastern University [a.pradeep@northeastern.edu](a.pradeep@northeastern.edu) CCS CONCEPTS • Security and privacy → Web application security; Privacy protections; KEYWORDS Sensors; Mobile browser; On-line tracking; Fingerprinting ACM Reference Format: Anupam Das, Gunes Acar, Nikita Borisov, and Amogh Pradeep. 2018. The Web’s Sixth Sense: A Study of Scripts Accessing Smartphone Sensors. In 2018 ACM SIGSAC Conference on Computer and Communications Security (CCS’18), October 15–19, 2018, Toronto, ON, Canada. ACM, New York, NY, USA, 18 pages. [https://doi.org/10.1145/3243734.3243860](https://doi.org/10.1145/3243734.3243860) 1 INTRODUCTION The dominant mode of web browsing has shifted towards mobile platfor

FAQs

What does the study measure about mobile web sensor use?

It measures the prevalence of scripts accessing smartphone sensor APIs and examines stateless tracking behavior on the mobile web.

How is OpenWPM extended for this research?

The work extends OpenWPM into OpenWPMMobile, adding the ability to emulate plausible smartphone sensor values and mobile browsing behavior.

What relationship does the study find between sensor access and fingerprinting?

It finds significant overlap: a majority of scripts accessing motion sensors also engage in browser fingerprinting.

How effective are existing privacy countermeasures against sensor misuse?

Popular tracking protection lists and privacy-focused browsers commonly fail to block many sensor-misusing tracking scripts and do not fully implement W3C-suggested mitigations.

Aug 27, 2026

Uploaded by Rowan