Every website that attempts to access your webcam and microphone must receive proper authorization within Google Chrome, unless you have manually blocked both devices. When these devices are activated, a small red dot appears on the responsible tab. However, a developer working at AOL discovered a bug that allows this visual indicator to be bypassed and secretly start recording audio and/or video without the user's knowledge.
Personally, I don't have a webcam connected to my desktop computer, and I never replaced the microphone after gravity explained some details about physical integrity. But the story is very different on laptops, which already integrate both accessories. The webcam-microphone combo has long been seen as a security risk, and there are users who place tape over the camera lens, completely disable the microphone, or open the computer to remove these components. On the other hand, many online services make legitimate use of the microphone and webcam without depending on external elements. All they require is a compatible browser, and due to popularity, Google Chrome tops the list.
The problem is that a recent version of the browser has a bug in the visual indicator that reports a site's access to the webcam and microphone. An AOL web developer named Ran Bar-Zik discovered this bug while working on a site running WebRTC code. For those who don't know, WebRTC is the protocol responsible for providing real-time audio and video streaming support. In a normal situation, the website asks the user for permission, and once it activates the devices, a small red dot appears on the tab. Bar-Zik detected that the code for making recordings does not need to be executed under the tab that originally asked for permission. What Google Chrome does is enable access to an entire domain, so a simple background popup is more than enough to record the user's activity and avoid the red indicator on the tab.
Bar-Zik created a proof of concept here for all interested users to evaluate what happens, and although he already reported the bug to Google, the response was a bit cold. Mountain View does not see the use of popups to record content and bypass the indicator as a security concern because the site absolutely needs the user's prior authorization, and Google Chrome doesn't even have such an indicator in its mobile version, although it admitted that the situation could be 'optimized'. In other words, there will most likely be an adjustment, but it's not something urgent.
Source: Bleeping Computer
