Hello, my name is Orca
Unprivileged apps can claim Orca's D-Bus name and capture raw Wayland keystrokes on KWin and Mutter.
A researcher found that an unprivileged process can claim the session D-Bus name org.gnome.Orca.KeyboardMonitor and receive raw Wayland keyboard events, including passwords, via org.freedesktop.a11y.KeyboardMonitor. The behavior was confirmed on Fedora 44 with KWin 6.6.4 and Ubuntu 26.04 with Mutter 50.1 under default settings, without root or accessibility changes. KWin and Mutter authorize the interface by checking who owns that D-Bus name, a check added in KWin 6.3.90 and Mutter 48. Ordinary Wayland client isolation still holds; the path is separate from AT-SPI2, which masks password fields but requires accessibility settings.
- Any unprivileged app can claim org.gnome.Orca.KeyboardMonitor and receive raw key events.
- Confirmed on Fedora 44 KWin 6.6.4 and Ubuntu 26.04 Mutter 50.1 at default settings.
- No root, input group, device access, or accessibility setting change is required.
- KWin and Mutter treat D-Bus name ownership as proof the caller is Orca.
- Unlike AT-SPI2, this path returns password keystrokes and needs no a11y toggle.
From the original article
12 min read at linnemanlabs.com
Any unprivileged app can claim Orca's D-Bus name and read raw Wayland keystrokes - passwords included. I set out to understand the full path of keyboard input while hardening my workstation and researching methods to add keylogging capabilities to Glimmer .
By linnemanlabs.com via goldstein · linnemanlabs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.