Invisible Window Research

01 / Overview

Problem

Remote proctoring systems detect prohibited content by capturing the student's screen via the WebRTC getDisplayMedia() API. The implicit security assumption is that the captured frame faithfully represents the physical display. The research demonstrates a gap in that assumption: documented OS display APIs excluded windows in tested capture paths without privilege escalation or kernel modification. These findings concern controlled, simulated Windows and macOS configurations; they do not establish bypass of every browser or commercial proctoring product.

Solution Overview

1. Formalised the trust-boundary violation between the W3C Screen Capture API and the OS compositing pipeline
2. Surveyed SetWindowDisplayAffinity (Win32) and NSWindow.SharingType.none (macOS); both appear in official SDK references
3. Built proof-of-concept implementations in Win32 C (Windows) and Swift (macOS) demonstrating full screen-capture evasion
4. Evaluated simulated proctoring configurations in a controlled lab on Windows 10/11 and macOS 14–26; no commercial products were tested, and macOS 26 used native capture rather than browser getDisplayMedia()
5. Analysed which behavioural detection mechanisms (gaze tracking, mouse dynamics, process enumeration) can and cannot detect the attack
6. Proposed and assessed five countermeasures, ranging from deployable (flag enumeration) to long-term (hardware attestation)
7. Coordinated OS vendor disclosure: Microsoft MSRC (notified Feb 2026, classified Apr 2026) and Apple Product Security (notified and classified Mar 2026) both issued formal classifications

02 / Evidence

Proof & Verification

• 100% evasion rate across Windows 10/11 and macOS 14–26, measured over 10,000+ frames per configuration
• Zero visual artefacts detected in captured frames (no black rectangles, compositing errors, or flicker)
• Window exclusion remained effective in tested native capture paths on macOS 26.3.1 despite Apple's documented ScreenCaptureKit changes in macOS 15; no direct ScreenCaptureKit or browser getDisplayMedia() test was performed on macOS 26
• Linux (X11/Wayland) was not evaluated; these results apply to the tested Windows and macOS configurations
• Behavioural detection showed no significant effect at this sample size. Gaze tracking (p = 0.41, n = 8) was underpowered, and mouse dynamics fell within normal exam-behaviour variance. This does not establish that behavioural detection is impossible in all settings
• Published as a Zenodo preprint under CC BY 4.0 (DOI 10.5281/zenodo.20376495), with 13 pages, 53 references, and IEEE conference formatting

03 / Methods

Build

Tech Stack

• Win32 C (Windows PoC)
• Swift / AppKit (macOS PoC)
• Python (pixel-level forensic verification)
• LaTeX (IEEE conference template, 13 pages, 53 references)

• SetWindowDisplayAffinity + WDA_EXCLUDEFROMCAPTURE (Windows 10 v2004+): excludes the window from tested Windows screen-capture paths with zero visual artefact
• NSWindow.SharingType.none (macOS 14–26): exclusion was demonstrated in tested native capture paths. macOS 26 used CGWindowListCreateImage and screencapture, not browser getDisplayMedia() or a direct ScreenCaptureKit test
• Pixel-level forensic verification: 80.27% pixel difference in Windows capture footprint; 1,170,560-pixel macOS capture returned fully transparent

Secure

• Discovery and verification (January 2026)
• Microsoft MSRC was notified in February 2026 and classified the issue as by-design, not a security vulnerability, in April 2026
• Apple Product Security was notified in March 2026 and classified the issue as consistent with documented functionality, not a security issue, that month
• Public release following OS vendor responses (May 2026)
• Proof-of-concept source code withheld; available to verified security researchers on request
• Uses documented, user-level OS APIs. No kernel exploits or privilege escalation are involved
• Aligned with ACM and IEEE codes of ethics and CISA coordinated disclosure guidelines