Video Chat as a Spy: A Gaze Driven Side-channel on Concurrent Apps in Mobile Multi-window Environments
- 1Shandong University
IEEE Transactions on Dependable and Secure Computing 2026
01 Motivation & Threat
Video calls may keep the front camera active while users interact with another app.
A remote participant can exploit subtle eye movements to infer PINs and ongoing activities.
Only the peer-side video stream is needed.
No privileged permissions or local malware.
No user/device calibration or device-class knowledge.
02 How XGazeLeak Works
Estimate relative gaze trajectories from video, then use two inference branches:
fixation clustering and keypad matching for PINs; temporal modeling for activities.
03 Key Findings
25 participants per task; primary devices: Huawei P40 Pro and iPad Pro.
47.16%
Mean Top-5 PIN accuracy
across PIN lengths
89.27%
Mean five-class activity accuracy
with 30-second windows
Your gaze can reveal what happens beyond the video call.
Original manuscript figures: iPad PIN results (left); video-chat activity results (right).