A security bug in IE -- real-time tracking of system mouse positions

DHTML in IE has various M $ private features, which are well known. It is interesting to see event. screenx and event. screeny, which can be used to obtain system-level mouse coordinates.

I think there is nothing at all. The coordinates on the screen are nothing more than the coordinates in the client area of the browser + the browser window coordinates + the client area offset.

IE itself can use the event and screen objects to obtain information related to various screen and form positions.

However, the real strange thing hasn't started yet! According to the standard DOM model definition,Only when an event is triggered can the parameters related to the event be obtained from the event.

That is to say, only when the mousemove is triggered and such a type of mousexxx mouse event is triggered can the mouse-related parameters be obtained. However,In IE, after any event is triggered, you can get event. screenx and event. screeny, even when the page is minimized!

Of course, you may say that this depends on an event. However,The event here can be any onxxx callback function, not limited to UI events.. So we can create it manually!

The simplest example:New ImageSet an invalidSRC, ItsOnerrorThe event was triggered immediately!

Therefore, we can get event. screenx in onerror, set invalid SRC, and trigger onerror again... So we can track the mouse pointer at the user's screen level in real time. Because the generation of onerror is not limited to any UI message, the event can still be triggered when the page is minimized or inactive!

Test address: http://www.etherdream.com/FunnyScript/CursorPosTest.html

Unfortunately, it is not possible to obtain the mouse or keyboard key that has been pressed. If the global button is captured, isn't it possible to listen for password input...

In fact, the trigger of non-UI events such as onerror does not involve any mouse or keyboard parameters in the browser form, so you cannot obtain various mouse and keyboard information. As for event. screenx, the only explanation is that it is a getter of the event. Internally, the getcursorpos win api is called directly, which is not provided by the event trigger.

It would be interesting if such tracking code is implanted on a page and the coordinates are transmitted back in real time through socket. Io...