[Security] Audio farbling bypass

[arthuredelstein]

Description

Fix a code path in our audio farbling where audio is not being farbled. See https://hackerone.com/reports/2846851

Summary:

A bug introduced in July 2024 allows websites to bypass Brave's audio fingerprinting protection when using Web Audio AnalyserNode methods. The BraveAudioFarblingHelper is only initialized when AudioBuffer methods (getChannelData or copyFromChannel) are called, but AnalyserNode methods require this helper for farbling. As a result, AnalyserNode data accessed before any AudioBuffer calls remains unfarbled and fingerprintable across sessions and domains, reducing user privacy.

Reproduces how often

Easily reproduced

Desktop Brave version (brave://version info)

Desktop Linux: Brave 1.73.89 Chromium 131.0.6778.69 (Ubuntu 22.04.5 LTS)
Android: Brave 1.73.89 Chromium 131.0.6778.69 (Android 14)

Android device

• Brand/model:
• Android version:

Channel information

• release (stable)
• beta
• nightly

Reproducibility

• with Brave Shields disabled
• with Brave Rewards disabled
• in the latest version of Chrome

[LaurenWags]

@arthuredelstein please add the following required labels as appropriate:

• QA/Yes or QA/No
  • If QA/Yes please include a test plan
• release-notes/exclude or release-notes/include

cc @kjozwiak

[kjozwiak]

@arthuredelstein @diracdeltas should we use release-notes/include as it's a Hackerone issue? We usually add anything related to Hackerone into the notes and give the reporter the credit. Unless this isn't severe enough to ass into the release notes.

[diracdeltas]

yes let's include it in the release notes, credit goes to https://hackerone.com/cesium_fusilli