Which makes me glad I am using wayland. I am not comfortable with the idea that one browser window could be aware of things like the position of another browser window on my desktop.
The browser doesn’t communicate such things between unrelated clients, say, on different domains. The browser does allow a site to communicate with the popup that it opened, which is what this game is doing, and is not problematic.
Yes, you can access window.screenX for your own window, but not for other windows. If you’re writing code for an iframe embedded into a domain that’s not yours, your code does not have access to the parent’s windows.screenX.
Firefox knows where all its windows are, of course, but that’s not the potential issue being raised. The problem is allowing untrusted javascript access to that info. Luckily, Firefox doesn’t do that, it only allows you (JavaScript author) window information for the windows you’ve directly opened in code.
Actually I don't think Firefox knows the position of the window in Wayland. I thought that coordinates of windows were considered as a compositor concern and not shared with the client.
Better even: the parent window knows the position of it's child window. So firefox only knows the one window. And that in a situation where you actively had to allow the permission for the parent to spawn the child in the first place.