Keep your dirty cross-origin paws off my pixels!

Time to take a look at your pixel orchard again

Chad firefox users unaffected

The article is saying that the gpus use a compression that is software independent and bypasses the restrictions on iFrame cross-website loading. Chrome and Edge are affected; Safari and Firefox are not.

It's a timing vulnerability, based on how long it takes the GPU to render the page , I think, although it's also browser specific.

But seems low risk.. at a minimum of 30 minutes to grab a username, you'd have to be sat on the same page for a while and not notice your fans ramping up..

Also, passwords seems a stretch. No (sane) site displays passwords.

The problem is that so many browsers leverage hardware acceleration and offer access to the GPUs. So yes, the browsers could fix the issue, but the underlying cause is the way GPUs handle data that the attack is leveraging. Fixing it would likely involve not using hardware acceleration.

As these patterns are processed by the iGPU, their varying degrees of redundancy cause the lossless compression output to depend on the secret pixel. The data-dependent compression output directly translates to data-dependent DRAM traffic and data-dependent cache occupancy. Consequently, we show that, even under the most passive threat model—where an attacker can only observe coarse-grained redundancy information of a pattern using a coarse-grained timer in the browser and lacks the ability to adaptively select input—individual pixels can be leaked. Our proof-of-concept attack succeeds on a range of devices (including computers, phones) from a variety of hardware vendors with distinct GPU architectures (Intel, AMD, Apple, Nvidia). Surprisingly, our attack also succeeds on discrete GPUs, and we have preliminary results indicating the presence of software-transparent compression on those architectures as well.

It sounds distantly similar to some of the canvas issues where the acceleration creates different artifacts which makes it possible to identify GPUs and fingerprint the browsers.

Here's one that won't enrage you.

Salesforce Marketing Cloud doesn't have a way for an external site to push a Post to a landing page / custom page without allowing all external sites.

You can't whitelist a specific site.

Bet some overworked and underappreciated engineer is working on it right as we speak.

All my apes, gone!

says in the article that firefox and safari aren't affected.

x-frame-options is a HTTP header (an obsolete one, too - use Content-Security-Policy instead) - a frontend framework isn't able to set that. Back end frameworks can, and probably should - or at least give you the option to with a default enabled value.

While WordPress could be configured to set it, it probably shouldn't do it in the PHP - the installation guides should be telling you how to do it in Apache HTTPD or Nginx, with a fallback to doing it in PHP if changing the server config isn't available.