Skip to main content

Chrome browser bug can let malicious sites eavesdrop

chrome browser bug can let malicious sites eavesdrop microphone
Image used with permission by copyright holder

If you’re the kind of PC user who covers your machine’s camera for fear of someone hacking into your computer and spying on you, you might want to stick something in the tiny mic hole as well – especially if Chrome is your browser of choice.

A NY Times report Wednesday revealed that a web developer has found a way to listen through a computer’s mic – even when the user thinks it’s off – by exploiting a vulnerability in Google’s browser.

The security flaw was uncovered by Tel Aviv-based developer Tal Ater while working on a tool that adds voice recognition functionality to websites.

In a blog post titled ‘Chrome bug allows sites to listen to your private conversations’, Aviv explains how malicious websites can gain access to your mic and listen in on private conversations within earshot of your machine, “even after you’ve left those sites….as long as Chrome is still running.”

In normal circumstances when using Chrome, a red marker appears on a tab when you give a website access to your mic. However, Ater’s discovery shows that even when you think you’ve turned the mic off and the red indicator disappears, or you close the tab, a pop-under window that appeared when you granted the site access ensures that the mic remains active, capturing nearby audio for as long as the browser stays open.

According to a video (below) on Ater’s site, the mic can also be “programmed to stay dormant and only start recording once you’ve said certain interesting keywords” – functionality that may well have NSA agents choking on their coffee in excitement when they find out.

The Web developer explained on his site that he reported the bug to Google’s security team in September, after which they quickly acknowledged the issue. However, four months on, a fix still hasn’t been released.

An unnamed source told the NY Times the Web giant decided not to issue a fix because “the voice recognition tool complies with Web standards,” and instead the company is “working on better visual clues to show that access to the microphone has been given.”

Although Ater says he has no knowledge of any hackers having taken advantage of the flaw, the general message here is for Web users to be sure that any site asking to access a machine’s mic is legitimate.

With voice recognition software expected to gain much wider use in the coming years, Internet giants like Google and Apple will be keen to eliminate these kinds of issues in an effort to allay privacy concerns over such matters.

If you’re a Chrome user and you’d like to check which sites currently have access to your machine’s mic, take the following steps:

– Click on the Chrome menu at the top right of your browser

– Click on Settings

– Click on Show advanced settings at the bottom

– Click on Content settings under Privacy

– Click on Manage exceptions under Media (you’ll need to scroll down a little way for this)

– If you’ve granted access to any sites in the past, they’ll show up here.

[Image: dencg / Shutterstock]

Editors' Recommendations

Trevor Mogg
Contributing Editor
Not so many moons ago, Trevor moved from one tea-loving island nation that drives on the left (Britain) to another (Japan)…
These 2 new Edge features are making Chrome look outdated
Copilot in Windows being used in the side panel.

Microsoft has announced a host of updates that will soon be available for its Edge browser, including the Microsoft 365 Copilot feature and Sidebar app support for developers.

The company is showcasing the new features during its annual Build developer conference, which is currently taking place from May 23 through May 25.

Read more
Google Chrome’s latest update solves the browser’s biggest problem
Google Chrome icon in mac dock.

Google Chrome is one of the best browsers around, but it's always had a big problem with memory usage. It's finally addressing the issue in a new Chrome 110 update that promises to reduce RAM usage by up to 30% and make the browser for efficient.

Chrome has a reputation for its speed, security, and feature drops, as well as a penchant for hanging on to your precious RAM like an episode of Hoarders. Granted, Google has made strides in improving Chrome's memory efficiency by hibernating tabs in the background, but it still struggles with it compared to Microsoft Edge or Mozilla Firefox.

Read more
Chrome’s take on Nvidia DLSS is set to launch, but you can’t use it yet
Three RTX 4080 cards sitting on a pink background.

Exciting new Nvidia tech is coming to Google Chrome, and on the browser side, the update is ready. We're talking about Nvidia's RTX Video Super Resolution (VSR), which is said to support upscaling up to 4K.

However, if you're itching to try it out, we have some bad news -- you can't use it just yet.

Read more