Researchers Uncover New GPU Attack That Leaks Visual Data

Researchers discovered a new GPU side-channel attack called GPU.zip that leaks visual data through compression. It was demonstrated stealing pixels and usernames.
The attack impacts major GPU vendors like AMD, Apple, Arm, Intel, Nvidia, and Qualcomm. No patches have been released yet.
GPU.zip exploits undocumented GPU compression as an optimization strategy to save memory bandwidth.
The attack uses SVG filters and measures render times to deduce pixel colors. It takes 30-215 minutes to extract usernames.
The attack currently works in Chrome by loading cross-origin iframes. Firefox and Safari are not vulnerable. Websites that block iframes cannot be attacked this way.

bleepingcomputer.com

Relevant topic timeline:

9/26/2023

GPU Side Channel Attack Bypasses Browser Security to Steal Sensitive Visual Data

A newly discovered cross-origin attack on GPUs allows malicious websites to read sensitive visual data displayed by other websites, violating the same origin policy and exposing usernames, passwords, and other private information.