Why Mozilla and Apple Avoid WebUSB and WebSerial APIs

This article explores why browser vendors Mozilla and Apple have refused to implement advanced hardware integration features like WebUSB and WebSerial, despite their availability in Google's Chromium-based browsers. While Google champions these APIs to bridge the gap between web applications and native software, the makers of Firefox and Safari argue that giving websites direct access to peripheral devices introduces severe security vulnerabilities, privacy risks, and user consent challenges that cannot be safely mitigated.

The Goal of Hardware Web APIs

Google introduced APIs like WebUSB, WebSerial, and WebHID as part of "Project Fugu," an initiative aimed at giving web applications the same capabilities as native desktop software. These APIs allow websites to communicate directly with connected hardware—such as 3D printers, microcontrollers, industrial equipment, and medical devices—without requiring the user to install specialized local drivers or native software.

While this functionality is convenient for developers and useful for browser-based operating systems like ChromeOS, Mozilla (Firefox) and Apple (Safari/WebKit) have formally categorized these APIs as harmful or worth avoiding. Their opposition comes down to four main areas of concern: device security, user consent, privacy, and the breakdown of the web's core security model.

1. Peripherals Are Not Built for the Web

The primary argument from Apple and Mozilla is that USB and serial devices were never designed to defend themselves against untrusted, potentially malicious code from the internet. When a device is plugged into a computer, it implicitly trusts the host system.

By exposing these devices directly to the browser, any website that gains access can send raw commands to the hardware. This creates several critical risks:

• Firmware Corruption: Many USB devices allow their internal software (firmware) to be updated over a USB connection without cryptographic verification. A malicious website could silently overwrite a device's firmware, permanently breaking it or turning it into a "BadUSB" device that attacks the host computer by emulating a keyboard.
• Data Extraction: Devices often store sensitive information without internal access controls. A website granted access to a connected smartphone, camera, or flash drive could bypass standard file-selection prompts and read or delete everything on the device.

2. The Flaw of Permission Prompts

Chromium browsers attempt to secure WebUSB and WebSerial by requiring the user to explicitly grant permission via a pop-up prompt before a website can access a device. However, Mozilla and Apple argue that permission prompts are not an effective security boundary for complex hardware.

When a browser asks for permission to use a webcam or microphone, the average user understands the implications. Conversely, the implications of granting raw USB or serial access are nearly impossible for a layperson to grasp. Users cannot easily tell if granting access will simply allow a website to read a sensor, or if it will allow the site to completely reprogram the device. Through social engineering, malicious websites can easily trick users into clicking "Allow," thereby bypassing the only layer of protection the browser offers.

3. Privacy and Device Fingerprinting

Both Apple and Mozilla heavily prioritize anti-tracking features in their browsers. Hardware APIs present a massive loophole for browser fingerprinting—a technique used to track users across the web based on their unique system configurations.

Connected hardware often broadcasts globally unique identifiers, such as factory serial numbers, MAC addresses, and specific vendor IDs. Unlike cookies, which a user can delete, hardware serial numbers are permanent. If a user grants a website access to a device, that site can record the hardware's unique identifier to track the user indefinitely, even across different browser profiles or in private browsing modes.

4. Breaking the Same-Origin Policy

The fundamental security model of the web is the "Same-Origin Policy," which dictates that data and permissions from one website are strictly isolated from another website.

Physical hardware does not understand or respect web origins. If a user connects a device to Website A, and later connects the same device to Website B, the device retains its state. A malicious Website A could leave malicious data on the device or alter its configuration in a way that exploits Website B, or even compromises the user's local operating system the next time a native application interacts with that hardware.

The Philosophical Divide

Ultimately, the disagreement over WebUSB and WebSerial highlights a philosophical divide in how the web should evolve. Google views the browser as an operating system that should eventually replace native apps entirely, which requires deep hardware access. Mozilla and Apple view the browser as a secure sandbox designed to protect the user from an untrusted internet, concluding that some hardware interactions are simply too dangerous to be exposed to the web.