The Patching Friars' AlmanacA calendar of CVE saints

September 12

GAZEploitHoly card for gazeploit, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 GAZEploit OCULUS PRODITOR
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Blessed GAZEploit, Who Read From the Eyes

Patron of mixed-reality headsets, avatars that mirror your gaze, and everyone who types by looking at the virtual keyboard.

Life

On 12 September 2024 a group of researchers described GAZEploit, an attack on Apple Vision Pro headsets. From the avatar that reproduces the user's face and gaze in video calls, one could infer the eye movements while they typed on the virtual keyboard, and from there reconstruct what they wrote, passwords included. Apple fixed it by hiding the avatar during typing.

Prayer

O Blessed GAZEploit, who reads the letters in the movements of the gaze, let our avatars close their eyes when we type. Amen.

How to celebrate

Celebrated by updating visionOS to the version that turns off the avatar while the virtual keyboard is in use.

An eye that types is a secret that's read.

Technical record

Disclosed on
September 12 2024
CVE
CVE-2024-40865
CVSS
5.3
Product
Apple · visionOS

The issue was addressed by suspending Persona when the virtual keyboard is active. This issue is fixed in visionOS 1.3. Inputs to the virtual keyboard may be inferred from Persona.

Sources: sites.google.com

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.