"User started" play accepts any play within Firefox's 5 s transient-activation window #230

Severity: low

Where: chrome/content.js (the capture play listener: if (!navigator.userActivation || !navigator.userActivation.isActive) return;, with the comment "A 'play' while the page is still handling a click or key press carries transient user activation; an autoplay does not.")

What happens

Transient activation persists for 5 s after any gesture in the document (Firefox dom.user_activation.transient.timeout), not only during the handler. A site that starts a preview or a next-episode autoplay up to 5 s after an unrelated click (opening a menu, dismissing a banner) gets its video reported as MPV_USER_PLAY and sent to mpv in shortcut mode. The e2e only covers the untrusted-event case ("counts no made-up play").

Suggested fix

Record the time of the last trusted pointerdown/keydown in onUserGesture (already a capture listener) and accept a play only within about 1 s of it and when the gesture's composedPath() included the video or a control inside the same player container; keep isActive as the outer gate.

Confidence: high on the 5 s window.

From a line-by-line code review of the tree at 41363fd (2026-10-02). Each claim above was checked against the source before filing; the reproduction steps and line references are as of that commit.

Generated by Claude Code