[laundermaf]

To be fair, you're supposed to get a permission dialog and it seems you have to pick the specific device(s) to connect to them.

https://web.dev/usb/#get-access-to-usb-devices

However I suppose that the mere existence of this API means that there could be a way to bypass the request; The browser already does have full access to every device.

[mschuster91]

Sweet jesus that's easy. Wonder if stuff like Samsung ODIN (which already has a OSS clone) could be ported to that.

[jeroenhd]

Definitely possible, especially with native-to-WASM tooling.

I've used a web page to run ADB commands to quickly debloat my phone, so I don't see why fastboot support wouldn't work.

There's even a tool to flash your Android phone through the browser (https://pixelrepair.withgoogle.com/ I believe). Adding "automated LineageOS installer through WebUSB" to my infinitely growing to-do list :)

[intelVISA]

That sounds great, I hope you pursue it.

Do you know of any specific risks when flashing devices w/ WebUSB as opposed to the 'normal' way?

[mschuster91]

With Google's devices I think and hope that the code accounts both on the web side and the device firmware side for interrupted communications or latency due to whatever external factors (e.g. another page that is running in the same execution context sending the single JS thread into a loop or lock).

With non-Google devices... these might run into problems when the device expects a certain response latency or minimum bandwidth. YMMV I'd say.

[kevingadd]

I believe the device also needs to be WebUSB compatible, unless that part of the design changed - it's a measure to reduce the attack surface by not letting webpages talk to old pre-WebUSB hardware that might have vulnerabilities.

[TobTobXX]

If I'be read it correctly it _can_ announce itself over WebUSB. And I suppose this announcement contains a landing URL, which Chrome will then show upon plug-in of the device. So device-side WebUSB capability seems like a feature, rather than a requirement for browser-side communication.

[selfhoster11]

It’s certainly not a requirement for the device to support WebUSB. NetMD recorders were created long before WebUSB, but can still be used from a browser app.

[selfhoster11]

Web MiniDisc folks ported the reverse-engineered the NetMD protocol tools to JS, and can now upload audio and patch device firmware on any MD device connected via Chrome/Chromium. Porting Odin is likely to be feasible.

[rany_]

Has been done with https://github.com/kdrag0n/fastboot.js, might be feasible with Odin as well..