The issue allows remote attackers to obtain sensitive information about a device's physical environment, and possibly discover PIN values, via a crafted web site. This is due to improper restriction of JavaScript access to orientation and motion data.