Hardware debugging interface illustrating wearable sensor vulnerabilities and side-channel leakage

Google Glass

Google Glass Developer program - more DOS and XSS

There were two very simple Google Glass Mirror's quickstart DOS and XSS vulnerabilities. The fixes have been introduced in changeset https

John W8MEJ Menerick May 3, 2013 1-minute read Updated August 18, 2026

Key takeaways

Wearables treat ambient environmental data as trusted input at their own peril.
When sensors are always listening and watching, unauthorized exfiltration becomes trivial.
Privilege separation must extend all the way to augmented reality peripherals.

There were two very simple Google Glass Mirror’s quickstart DOS and XSS vulnerabilities. The fixes have been introduced in changeset https://github.com/googleglass/mirror-quickstart- java/commit/738352eb5b5b73aa7bb911d0aeee3386f40dbf26

The DOS fix is rather simple. Limit the request to 1000 lines. The XSS fix is hackish but works. Instead of reflecting the client’s input back to the user, the error is directed to the error logging infrastructure. Let’s hope the error logging infrastructure is anti-XSS enabled.

About the author

John W8MEJ Menerick

Explore cutting-edge cybersecurity insights and protective strategies with John Menerick. Deep dives, threat analysis, and live streams from securesql.info.

Research Speaking About

Related reading

Autonomous Incident Response at Scale: How Energy-Based Models & TAME Replace LLM Guessing in Security

Security Theater and Cap Tables: Deconstructing Cal.com's Closed-Source Pivot

Episode 2: The Layer 2 Bridge Lab