Screen reader reads the data while computer is locked

[Ivan Roganov]

# lsb_release -rd
Description: Ubuntu 22.04 LTS
Release: 22.04

# apt-cache policy gnome-shell
gnome-shell:
  Installed: 42.0-2ubuntu1
  Candidate: 42.0-2ubuntu1
  Version table:
 *** 42.0-2ubuntu1 500
        500 http://us.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
        100 /var/lib/dpkg/status

Ubuntu is installed on a laptop. Within five minutes of inactivity, the screen lock activates and locks the system. Computer is secured. 10 minutes later, my cat (her name is Loaf) comes up to the laptop and sits down on the keyboard. This activates a screen reader. (Shortcut is Alt + Super + S)

What I've expected:
Screen reader would start reading the contents of a lock screen

What happened:
Screen reader app started reading contents of a Brave Browser window that was opened on my desktop. It read all tabs and proceeded reading the opened web page.

I've reported this bug at <email address hidden> and got the following answer:

> Nice find - I am able to reproduce this locally in Ubuntu 22.04 LTS too
> - I suspect this is a vulnerability in gnome-shell as it is
> responsible for handling the lock screen in standard Ubuntu.

As per further directions, I'm posting this bug here and in gnome repo.

P.S. I expect Loaf being credited for this find. She really likes treats.
---
ProblemType: Bug
ApportVersion: 2.20.11-0ubuntu82
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
DisplayManager: gdm3
DistroRelease: Ubuntu 22.04
InstallationDate: Installed on 2021-10-24 (201 days ago)
InstallationMedia: Ubuntu 21.10 "Impish Indri" - Release amd64 (20211012)
Package: gnome-shell 42.0-2ubuntu1
PackageArchitecture: amd64
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/usr/bin/zsh
ProcVersionSignature: Ubuntu 5.15.0-27.28-generic 5.15.30
RelatedPackageVersions: mutter-common 42.0-3ubuntu2
Tags: wayland-session jammy
Uname: Linux 5.15.0-27-generic x86_64
UpgradeStatus: Upgraded to jammy on 2022-04-28 (15 days ago)
UserGroups: adm cdrom dip docker libvirt lpadmin lxd plugdev sambashare sudo
_MarkForUpload: True

[Seth Arnold (seth-arnold)]

Good job Loaf :3

[Daniel van Vugt (vanvugt)]

I can't seem to reproduce the bug. In both Wayland and Xorg sessions pressing Super+Alt+S on the lock screen just reads the lock screen.

[Daniel van Vugt (vanvugt)]

Please run:

  apport-collect 1972889

so we can see if there's anything unusual about your system.

[Ivan Roganov (newarked)]

apport information

[Ivan Roganov (newarked)]

apport information

[Ivan Roganov (newarked)]

apport information

[Ivan Roganov (newarked)]

apport information

[Ivan Roganov (newarked)]

apport information

[Ivan Roganov (newarked)]

Also, I want to make sure that we did not miss this part:

Opened browser is Brave. It's a chromium-based browser, and then I would lock a computer, with this, pressing Alt+Super+S would start reading chromium interface.

[Daniel van Vugt (vanvugt)]

Please uninstall these extensions:

'<email address hidden>',
'<email address hidden>',
'<email address hidden>',
'<email address hidden>',
'tiling-assistant@leleat-on-github'

and also run:

  cd ~/.local/share/gnome-shell/
  rm -rf extensions

and then log in again. Does the bug still happen?

[Launchpad Janitor (janitor)]

[Expired for gnome-shell (Ubuntu) because there has been no activity for 60 days.]