Can you abuse this API? Maybe! It needs to be researched before making bombastic claims. From what I can tell the API is opt-in only and there is no way to enum

Can you abuse this API? Maybe! It needs to be researched before making bombastic claims. From what I can tell the API is opt-in only and there is no way to enumerate all devices. EDIT: One way to abuse the API (keep in mind that this is a documented risk in the spec) is in case of XSS accessing devices which are already granted permissions for. For example, if your health app has access to your heart rate monitor, an XSS vector will potentially have the power to pull this information straight from the device or abuse it in some other way if the device suffers from input validation problems. The former is not such a big deal because in case of XSS it is assumed that access to private information is granted. The later is slightly more interesting but you need scale to pull an interesting exploitation. It can be done but it is limited at present IMHO.