every other third-party embed in the client uses a click-to-play facade specifically so no
request reaches the provider before the user opts in, and image/video content honours mediaAutoLoad. MLocation takes neither: as soon as an m.location event scrolls into view it mounts an openstreetmap.org iframe. A remote sender can therefore use a location message as a read-beacon —
the recipient's IP and approximate view time are disclosed to a third party the moment they open the
room, with no interaction.
How to trigger
send an m.location event to a room; the recipient's browser hits www.openstreetmap.org on render.
Suggested fix
render the coordinates + "Open location" button by default and mount the map iframe only
after a click (reuse the existing embed facade), or gate it behind the mediaAutoLoad setting.
Filed from the September 2026 client audit (branch lotus @ 4bea4895).
**Severity:** low · **Type:** security · **Confidence:** high
**Location:** `src/app/components/message/MsgTypeRenderers.tsx:634-680`
### Problem
every other third-party embed in the client uses a click-to-play facade specifically so no
request reaches the provider before the user opts in, and image/video content honours `mediaAutoLoad`.
`MLocation` takes neither: as soon as an `m.location` event scrolls into view it mounts an
`openstreetmap.org` iframe. A remote sender can therefore use a location message as a read-beacon —
the recipient's IP and approximate view time are disclosed to a third party the moment they open the
room, with no interaction.
### How to trigger
send an `m.location` event to a room; the recipient's browser hits `www.openstreetmap.org` on render.
### Suggested fix
render the coordinates + "Open location" button by default and mount the map iframe only
after a click (reuse the existing embed facade), or gate it behind the `mediaAutoLoad` setting.
---
_Filed from the September 2026 client audit (branch `lotus` @ 4bea4895)._
jared
added this to the Audit 2026-09 · Medium & Low milestone 2026-09-12 01:51:23 -04:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Severity: low · Type: security · Confidence: high
Location:
src/app/components/message/MsgTypeRenderers.tsx:634-680Problem
every other third-party embed in the client uses a click-to-play facade specifically so no
request reaches the provider before the user opts in, and image/video content honours
mediaAutoLoad.MLocationtakes neither: as soon as anm.locationevent scrolls into view it mounts anopenstreetmap.orgiframe. A remote sender can therefore use a location message as a read-beacon —the recipient's IP and approximate view time are disclosed to a third party the moment they open the
room, with no interaction.
How to trigger
send an
m.locationevent to a room; the recipient's browser hitswww.openstreetmap.orgon render.Suggested fix
render the coordinates + "Open location" button by default and mount the map iframe only
after a click (reuse the existing embed facade), or gate it behind the
mediaAutoLoadsetting.Filed from the September 2026 client audit (branch
lotus@4bea4895).