CAPEC-508
Shoulder Surfing
In a shoulder surfing attack, an adversary observes an unaware individual's keystrokes, screen content, or conversations with the goal of obtaining sensitive information. One motive for this attack is to obtain sensitive information about the target for financial, personal, political, or other gains. From an insider threat perspective, an additional motive could be to obtain system/application credentials or cryptographic keys. Shoulder surfing attacks are accomplished by observing the content "over the victim's shoulder", as implied by the name of this attack.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-508: Shoulder Surfing: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/508.html and https://cve.bz/cve/capec/508?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
Prerequisites
The adversary typically requires physical proximity to the target's environment, in order to observe their screen or conversation. This may not be the case if the adversary is able to record the target and obtain sensitive information upon review of the recording.
Skills required
- Low skill
In most cases, an adversary can simply observe and retain the desired information.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Read Data | Confidentiality | High likelihood |
Mitigations
Be mindful of your surroundings when discussing or viewing sensitive information in public areas.
Pertaining to insider threats, ensure that sensitive information is not displayed to nor discussed around individuals without need-to-know access to said information.
Weaknesses it exploits
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
Recent CVEs with these weaknesses
- 8.2CVE-2026-124037
An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker who had a community's public sign-up link and a register…
- 4.3CVE-2026-124944
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160.
- 4.3CVE-2026-124941
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- 4.3CVE-2026-124930
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- 4.3CVE-2026-124929
Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- 4.3CVE-2026-124925
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160.
- 4.3CVE-2026-124909
Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.
- 5.3CVE-2026-96769
The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unaut…
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
Examples
An adversary can capture a target's banking credentials and transfer money to adversary-controlled accounts.
An adversary can capture a target's banking credentials and transfer money to adversary-controlled accounts.
An adversary observes the target's mobile device lock screen pattern/passcode and then steals the device, whi…
An adversary observes the target's mobile device lock screen pattern/passcode and then steals the device, which can now be unlocked.
An insider could obtain database credentials for an application and sell the credentials on the black market.
An insider could obtain database credentials for an application and sell the credentials on the black market.
An insider overhears a conversation pertaining to classified information, which could then be posted on an an…
An insider overhears a conversation pertaining to classified information, which could then be posted on an anonymous online forum.
MITRE's words, unchanged: CAPEC-508 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.