Is it possible to fake JavaScript sensor events that fire on window object?

Question

JavaScript supports multiple event types for measuring mobile device sensors. These events fire on the window object e.g.

window.addEventListener("deviceorientation", function () {
  // do something with device orientation
}, true);

window.addEventListener("devicemotion", function () {
  // do something with acceleration
}, true);

When such an event fires, can you be sure that the browser itself (and hence the user ultimately) was the source of the event or is it possible for another script to generate such events?

In other words, developer tools aside, could a third-party script from a different source entirely (e.g. an ad or analytics script) create events that appear to be from a hardware sensor?

Answer 1

You can fake these sensor readings using Chrome's dev tools and for an advanced JavaScript programmer it should be not a big problem to overwrite the internal methods responsible for this, but it would be much easier to just take your code and change it, so it doesn't matter what sensor events are transmitted.

Short version: No you cannot be sure, but it takes some knowledge to fake this.