Skip to content

Remove navigator.connection from Brave-core #20122

@pes10k

Description

@pes10k

Chromium allows sites to learn about local network conditions by querying navigator.connection. This is privacy harming information. It can be used by fingerprinters, as well as by more determined attackers to potentially learn about user traveling patterns (including when the user is at home or not).

Ideal behavior here would be for the below to both be true in all shields configurations:

navigator.connection === undefined
"connection" in window.navigator === false

An ideal implementation would also include a brave://flags option (default off) that advanced users could use to re-enable the API. The flag description should have text mentioning that the functionality risks their privacy.

Metadata

Metadata

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions