GAZEploit remote keystroke inference

1. Summary

The Apple Vision Pro “Presence” component, which renders the wearer’s photorealistic Persona avatar for video calls and streaming, faithfully reproduces the wearer’s real-time eye motion and gaze direction [2][7]. Because the Vision Pro virtual keyboard is gaze-controlled — the user looks at a key and pinches to select it — the avatar’s rendered eyes carry a signal correlated with what the user is typing [1]. A remote observer who captures the shared Persona video can estimate the wearer’s gaze, detect typing sessions, reconstruct the virtual keyboard layout, and infer typed text such as messages, passwords, PINs, emails, and URLs, without any access to the headset [1][7].

2. Affected products & versions

3. The vulnerability in detail

Where the flaw lives. The defect sits in the Apple visionOS “Presence” component — the subsystem that generates and transmits the Persona avatar, a photorealistic virtual likeness of the wearer used during FaceTime calls, third-party meeting/streaming apps, and live streams [2][7]. Persona is a sanctioned, expected output: its entire purpose is to make the headset-wearing user visible and expressive to remote participants, including reproducing facial expression, eyelid state, and — critically — eye and gaze motion [1][2]. The leakage occurs specifically in the Persona rendering/output path, where the wearer’s real-time eye/gaze state is reproduced into shared video and crosses the headset boundary to remote viewers [7]. The available sources name the “Presence” component but do not identify the specific internal software module or file that renders Persona eye motion; there is no source-level detail.

Root cause / the actual defect. This is an inference-channel / information-leakage defect, not a memory-safety, injection, or access-control bug [1]. The root cause is a missing isolation boundary between two distinct uses of the same physical signal — the user’s gaze:

1. On the Vision Pro, gaze is the input mechanism for the virtual keyboard: the user looks at a key to target it, then pinches to commit it [1]. This makes eye position a direct function of the character being typed.
2. Persona reproduces that same real-time eye motion into the outbound avatar video [2].

Because no separation existed between the gaze-as-keyboard-input channel and the gaze-as-avatar-rendering channel, keystroke-correlated eye motion was faithfully rendered into a stream visible to any remote viewer of the avatar [2][7]. In world-model terms, the Persona output is a faithful, invertible rendering of a sensitive internal variable (the wearer’s gaze state): the avatar preserves enough of the gaze signal that an observer can run the rendering backwards and recover the input. NVD assigns no specific weakness class — it is recorded as NVD-CWE-noinfo [3] — but conceptually this is an information-exposure through an observable side/inference channel: sensitive biometric (gaze) data, and the text it encodes, is disclosed to an actor who should only be receiving an avatar likeness. The weakness is not that gaze is shown at all, but that it is shown at fidelity sufficient to invert while the keyboard is being used.

Mechanism and how it is triggered, with preconditions. The attack is fully remote and passive. It needs only the shared avatar video — no access to, compromise of, or RF/physical proximity to the victim’s headset, and no authentication or attacker-side user interaction beyond capturing the video [7]. Preconditions are: (1) the victim device runs visionOS before 1.3; (2) the victim uses gaze-controlled text entry on the virtual keyboard; (3) the victim’s Persona avatar is visible to the attacker — e.g., in a shared video call, online meeting, live stream, or via a malicious website/app; and (4) the attacker can capture that avatar video [4][7].

From the avatar’s rendered eyes, the attack extracts two eye-related biometrics: the Eye Aspect Ratio (EAR), capturing blink/eyelid state, and an estimated gaze direction [5]. A supervised classifier consumes these features to first detect typing sessions — distinguishing intervals when the wearer is entering text on the virtual keyboard from other VR/MR activity — reported at 85.9% precision and 96.8% recall [4][5]. Within a detected typing session, the attack reconstructs the virtual keyboard layout and maps each estimated gaze fixation onto the key the wearer was most likely looking at, producing candidate keystrokes per fixation [4][7]. Chaining those per-fixation guesses reconstructs the typed text [1].

Step-by-step exploitation chain [1][4][7]:

1. The victim (visionOS < 1.3) shares their Persona avatar in a video call, online meeting, live stream, or via a malicious website/app.
2. The attacker remotely captures the shared Persona/avatar video feed — no headset access needed.
3. The pipeline extracts eye biometrics (EAR and estimated gaze direction) from the avatar’s rendered eyes.
4. A supervised classifier flags typing sessions versus non-typing VR activity.
5. During a typing session, the virtual keyboard layout is reconstructed and gaze-direction estimates are aligned to it.
6. Per-fixation gaze-to-key mapping yields inferred keystrokes, reconstructing typed content — messages, passwords, PINs, emails, URLs.
7. (Optional, separate boundary) Recovered credentials/passwords are reused by the attacker to gain unauthorized account access.

Proof-of-concept status. This is an academic proof-of-concept with public demonstration. The attack (dubbed GAZEploit) was developed and evaluated by researchers, accepted at ACM CCS 2024 (arXiv:2409.08122), and evaluated on 30 participants with over 80% keystroke-inference accuracy; the team also identified 15+ top-rated App Store apps as vulnerable [1]. The project site publishes an attack overview and a demonstration video showing keystroke reconstruction from Persona views [4].

The underlying weakness (CWE). NVD records NVD-CWE-noinfo — no specific weakness ID was assigned [3]. The behavior is best understood as information exposure through an inference/observable channel: a rendered output (the avatar) that is meant to convey one thing (appearance/expression) also leaks a correlated sensitive internal variable (gaze) at a fidelity that lets an observer reconstruct private input. It is the same class of problem as a keyboard-acoustic or reflection side channel, except here the “channel” is a sanctioned, intentional video feature rather than an unintended physical emanation.

4. Discovery & timeline

The attack was discovered and disclosed by researchers from the University of Florida (Warren B. Nelms Institute), Texas Tech University, and CertiK’s Skyfall Team [5][6]. Named authors on the paper are Hanqiu Wang, Zihao Zhan, Haoqi Shan, Siqi Dai, Max Panoff, and Shuo Wang [1]. The researchers responsibly disclosed the flaw to Apple [5].

visionOS 1.3, which contains the fix, was released in late July 2024 — commonly cited as July 29, 2024 (the cited source [6] gives only “late July”; the precise day is widely cited but not stated verbatim in the fetched cited sources) [6]. Apple’s security advisory was subsequently updated on September 5, 2024 to add the CVE-2024-40865 entry, and public technical writeups appeared in September 2024 (ACM CCS’24; arXiv, Sep 2024) [6][7]. The exact date the researchers first reported to Apple is not documented in the available sources; only the 1.3 release (late July 2024) and the September 5 advisory update are on record.

5. Technical reference

• CVE: CVE-2024-40865 [3].
• CWE: NVD-CWE-noinfo (no specific weakness assigned; conceptually information-exposure / inference-channel leak of biometric gaze data) [3].
• CVSS v3.1: Base 5.3 MEDIUM, vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N [3]. What the metrics mean here: AV:N (network) and AC:L / PR:N / UI:N reflect that the attack is remote, passive, needs no privileges, and no victim interaction beyond normal Persona use; S:U (unchanged scope) and C:L / I:N / A:N model it as a low confidentiality-only impact — a single “low” bucket that, as Section 6 argues, understates both the sensitivity of reconstructed text and the downstream authority a recovered credential confers.
• Official NVD/vendor description: “The issue was addressed by suspending Persona when the virtual keyboard is active. This issue is fixed in visionOS 1.3. Inputs to the virtual keyboard may be inferred from Persona.” [3]
• Code/commit refs: None available. The fix is described behaviorally (suspend Persona during keyboard use); no source-level or commit references are published [2].
• Reported measurements: typing-detection precision 85.9% / recall 96.8% [5]; >80% keystroke-inference accuracy across 30 participants [1]; 15+ vulnerable App Store apps [1].

6. Consequence & CFSE path analysis

Real-world consequence: A remote party who can see a Vision Pro user’s Persona avatar — in a call, meeting, stream, or via a malicious page — can reconstruct what that user types on the virtual keyboard, including private messages, emails, URLs, PINs, and passwords, with over 80% accuracy and without ever touching the headset [1][7]. When the reconstructed text is a credential, the attacker can attempt to reuse it, crossing from disclosure into unauthorized account access [4].

Why the CFSE Path Score differs from CVSS. CVSS scores this 5.3 MEDIUM with C:L/I:N/A:N — a single low-confidentiality bucket. That collapses two things the CFSE path model keeps distinct: the invertibility of the leaked signal and the authority that leaked credentials confer. The CFSE verdict is CRITICAL, direction UNDER relative to the published 5.3 MEDIUM baseline.

CFSE consequence bands and verdict:

verdict: CRITICAL. The entry models two co-dominant consequence paths, both banded CRITICAL. The perception-privacy path (PERCEPTION_PRIVACY / privacy family) captures how the sanctioned Persona avatar output carries gaze-correlated eye motion across the headset boundary and can be inverted to reconstruct the virtual keyboard layout and typed content, disclosing private text to a remote observer with no headset access. The account-authority path (ACCOUNT_AUTHORITY / authority family) captures that the reconstructed keystrokes may include passwords or credentials whose successful reuse crosses a separate boundary into unauthorized account access. Both paths record LS:PATCH_AVAILABLE, reflecting the visionOS 1.3 fix. The overall path_verdict is CRITICAL (direction UNDER relative to the published 5.3 MEDIUM CVSS baseline), driven by requirement #9 (representation / inference-channel leakage — a faithful, invertible avatar rendering of a sensitive internal gaze variable) and requirement #3 (authority-leak weakness class, since a recovered credential confers account authority rather than only low-sensitivity disclosure).

In short: CVSS treats this as “some low-sensitivity info might leak.” The CFSE path analysis recognizes that the leaked channel is a faithful, invertible rendering of a sensitive internal variable (req #9) and that a subset of recovered text is credentials that grant account authority (req #3) — two co-dominant CRITICAL paths that the flat C:L metric cannot express.

7. Remediation & mitigations

• Apply the vendor fix — update to visionOS 1.3 or later. Apple’s fix suspends the Persona avatar (freezes/stops transmitting live eye motion) whenever the virtual keyboard is active, which severs the correlation between typed keystrokes and the avatar’s visible gaze — directly removing the inference channel at its source [2][3][6].
• User-side residual precaution: users concerned about residual gaze leakage can avoid sharing their Persona while entering sensitive text (passwords, PINs), independent of patch level [remediation, seed].
• Because the fix is a rendering-behavior change inside Presence, there is no configuration hardening, network control, or SOC detection that meaningfully substitutes for it — the mitigation is the version update (or not sharing Persona during sensitive entry). No bug-specific detection signature is published.

8. Sources

[1] GAZEploit: Remote Keystroke Inference Attack by Gaze Estimation from Avatar Views in VR/MR Devices (arXiv:2409.08122) — arXiv (UF / CertiK Skyfall / Texas Tech; ACM CCS’24) — https://arxiv.org/abs/2409.08122 — Canonical academic paper: defines the EAR + gaze-direction pipeline, gaze-controlled keyboard premise, 30-participant evaluation, >80% accuracy, 15+ vulnerable apps, and author list. Credibility: researcher-primary.

[2] About the security content of visionOS 1.3 — Apple — https://support.apple.com/en-us/120915 — Official vendor advisory: names the Presence/Persona component, the impact, the “suspend Persona when keyboard is active” fix, the 1.3 fixed version, and researcher credit. Credibility: primary-advisory.

[3] NVD — CVE-2024-40865 — NIST NVD — https://nvd.nist.gov/vuln/detail/CVE-2024-40865 — Authoritative record: CVSS v3.1 5.3 MEDIUM vector, NVD-CWE-noinfo, affected/fixed version data, official description. Basis for the published baseline. Credibility: primary-advisory. (Verified verbatim during this review.)

[4] GAZEploit project site — GAZEploit research team — https://sites.google.com/view/gazeploit/ — PoC/demo site: attack overview, threat model, and demonstration video of gaze-to-keystroke reconstruction; supports classifier-then-mapping mechanism and no-in-the-wild-evidence note. Credibility: researcher-primary.

[5] Researchers Uncover Apple Vision Pro Security Flaw (GAZEploit) — University of Florida, Warren B. Nelms Institute — https://iot.institute.ufl.edu/2025/06/gazeploit-apple-vision-pro-security-flaw/ — Home-institution page: two-biometric approach (EAR + gaze), typing-detection precision/recall, responsible disclosure. Credibility: researcher-primary.

[6] Apple Patches Vision Pro Vulnerability to Prevent GAZEploit Attacks — SecurityWeek — https://www.securityweek.com/apple-patches-vision-pro-vulnerability-to-prevent-gazeploit-attacks/ — Reputable press: ties CVE to the 1.3 patch (released “late July” 2024), the suspend-Persona mitigation, affected component, September 5 advisory update, and disclosure narrative. Credibility: reputable-press.

[7] Apple Vision Pro Vulnerability Exposed Virtual Keyboard Inputs to Attackers — The Hacker News — https://thehackernews.com/2024/09/apple-vision-pro-vulnerability-exposed.html — Independent press: remote/passive threat model over shared Persona video, >80% accuracy, no-device-access framing, gaze-to-key mapping. Credibility: reputable-press.

[8] CVE-2024-40865 (CVEdetails) — CVEdetails — https://www.cvedetails.com/cve/CVE-2024-40865/ — Aggregated record restating the official description, version data, and CVSS scoring; cross-check of machine-readable metadata. Credibility: reputable-press (aggregator).