25554 2014-05-05 17:42:30 +0000 Require permissions to call control methods of HTMLMediaElement without user interaction 2016-04-27 16:55:54 +0000 1 1 1 Unclassified HTML WG HTML5 spec unspecified All All RESOLVED WONTFIX P2 minor --- 1 cypher543 dave.null arronei cypher543 mike philipj public-html-admin public-html-wg-issue-tracking travil public-html-bugzilla oldest_to_newest 105056 0 cypher543 2014-05-05 17:42:30 +0000 Currently, scripts can call methods of HTMLMediaElement to pre-load and auto-play media even when the "preload" and "autoplay" attributes aren't applied or are blocked, allowing pages to consume data in the background without the user's knowledge. I propose that permission be required to call control methods (load, play, pause, etc) of HTMLMediaElement without user interaction. 126207 1 travil 2016-04-27 16:55:54 +0000 HTML5.1 Bugzilla Bug Triage: Won't Fix While media manipulation could be abused by JavaScript in the way you describe it seems like it would be a conflict of interest for the site. In other words, why would the site that owns both the media element creation (and it's attributes) have dueling JavaScript that did something it didn't like? Naturally, as other libraries are often included in a page that could do bad things, there is a risk, but that is the risk taken whenever external code is loaded into the context of a page (and not done through an iframe). Furthermore, similar ideas are currently being discussed in the "interventions" spec, which aims to track what browsers are doing to mitigate these types of issues, and come to a mutual agreement on what may be standardized. I'd encourage you to participate there: https://github.com/WICG/interventions If this resolution is not satisfactory, please copy the relevant bug details/proposal into a new issue at the W3C HTML5 Issue tracker: https://github.com/w3c/html/issues/new where it will be re-triaged. Thanks!