[Security] Audio farbling bypass

[arthuredelstein]

Description

Fix a code path in our audio farbling where audio is not being farbled. See https://hackerone.com/reports/2846851

Summary:

A bug introduced in July 2024 allows websites to bypass Brave's audio fingerprinting protection when using Web Audio AnalyserNode methods. The BraveAudioFarblingHelper is only initialized when AudioBuffer methods (getChannelData or copyFromChannel) are called, but AnalyserNode methods require this helper for farbling. As a result, AnalyserNode data accessed before any AudioBuffer calls remains unfarbled and fingerprintable across sessions and domains, reducing user privacy.

Reproduces how often

Easily reproduced

Desktop Brave version (brave://version info)

Desktop Linux: Brave 1.73.89 Chromium 131.0.6778.69 (Ubuntu 22.04.5 LTS)
Android: Brave 1.73.89 Chromium 131.0.6778.69 (Android 14)

Android device

• Brand/model:
• Android version:

Channel information

• release (stable)
• beta
• nightly

Reproducibility

• with Brave Shields disabled
• with Brave Rewards disabled
• in the latest version of Chrome

[LaurenWags]

@arthuredelstein please add the following required labels as appropriate:

• QA/Yes or QA/No
  • If QA/Yes please include a test plan
• release-notes/exclude or release-notes/include

cc @kjozwiak

[kjozwiak]

@arthuredelstein @diracdeltas should we use release-notes/include as it's a Hackerone issue? We usually add anything related to Hackerone into the notes and give the reporter the credit. Unless this isn't severe enough to ass into the release notes.

[diracdeltas]

yes let's include it in the release notes, credit goes to https://hackerone.com/cesium_fusilli

[arthuredelstein]

QA testing (copied from https://hackerone.com/reports/2846851 by https://hackerone.com/cesium_fusilli):

1. Ensure "Block fingerprinting" is toggled on
2. Visit the page at https://arthuredelstein.github.io/tracking_demos/brave_analyser_node_poc.html
3. Note the fingerprint values in both tables
4. Open a new private window
5. Load same page again
6. Compare the results. When this fix is applied, all results should be different between windows

[MadhaviSeelam]

Verification PASSED using

Brave | 1.75.161 Chromium: 132.0.6834.83 (Official Build) beta (64-bit)
-- | --
Revision | 7e59e37e24ad33062e0f20e842236aa03f579407
OS | Windows 11 Version 24H2 (Build 26100.2894)

Reproduced the issue in 1.74.48 using the STR/testplan from #42356 (comment)

brave://settings/shields	Normal window	Private window

Confirmed that the fingerprint values in Normal window and Private window for both the tables are different in 1.75.161 as expected.

brave://settings/shields	Normal window	Private window

[Uni-verse]

Verified on Samsung Galaxy S21 using version:

Brave	1.75.164 Chromium: 132.0.6834.83 (Official Build) beta (64-bit) 
Revision	befbba8d7568f8713d6f942f9a7350c59b57f20a
OS	Android 13; Build/TP1A.220624.014; 33; REL

• Ensured that fingerprint values in Before getChannelData & After getChannelData tables are different when viewing in private tab using test plan mentioned in [Security] Audio farbling bypass #42356 (comment)

example	example