Google Chrome Hack Allows Websites to Listen to You

Google Chrome Hack Allows Websites to Listen to You

  • By Ginger Hill
  • Jan 22, 2014

Google Chrome Hack Allows Websites to Listen to YouHere’s a thought. You’re a die-hard Google Chrome fan, so every time you peruse the Internet it’s Chrome all the way. In fact, you’re such a pro that you have even enabled voice-recognition. Pretty high tech. At least that’s what voice-recognition apps developer Tal Ater thought until he noticed sometime strange hidden in the background.

Chrome users listen up! Any site that’s enabled for voice-recognition has the ability to use a pop-up window to record your voice almost indefinitely without you even knowing. Ater demonstrated this by closing a tab in Chrome, yet he continued talking. He then revealed a pop-up behind the main Chrome window that was transcribing everything he was saying.

Scary? I’d say, especially if it’s a malicious site using Chrome to listen to people’s offline conversations. Just think of all the details the “bad guys” could learn about you!

So, what’s the deal with Chrome? Once you’ve given an HTTPS-enabled site permission to use your mic in Chrome, you’ve just given the whole site, even pop-ups in the background, permission. And, with the code running in a different window, none of Chrome’s recording icons will initiate, so it looks like nothing is accessing your computer at all.

What should you do? Manually revoke the microphone permissions, which most of us, me included, would never even think to do.

This bug was first reported to Google in September 2013, and while their engineers have isolated the problem, the “fix” still hasn’t made it to user computers.

And, a future warning? There is a new class of apps being developed that require even more invasive permissions. Think in-browser services, like Google Hangouts, even though more convenient because you don’t have to reauthorize your mic for each session, blanked permissions can create a privacy issue.

(Photo credit: antb / Shutterstock.com)

About the Author

Ginger Hill is Group Social Media Manager.

Featured

  • Securing the Future

    Two security experts sit down with Security Today’s editor in chief Ralph C. Jensen to discuss what they see emerging and changing over the next several years along with how security stakeholders can harness these innovations into opportunities. Read Now

  • Collaboration Made Easy Using a Work Management Platform

    Effective collaboration between security operators, teams and other departments is critical to the smooth functioning of organizations. Yet, as organizations grow in complexity, it becomes more difficult for teams to coordinate with each other. This is compounded by staffing shortages, turnover and ineffective collaboration tools. Read Now

  • Creating a Safer World

    Managing and supporting locks and door hardware within a facility is a big responsibility. A building’s security needs to change over time as occupancy and use demands evolve, which can make it even more challenging. Read Now

  • Report: 78 Percent of CISOs Seeing Significant Impact from AI-Powered Cyber Threats

    Darktrace recently unveiled its 2025 State of AI Cybersecurity report. The findings reveal that 78% of Chief Information Security Officers (CISOs) surveyed say that AI-powered threats are having a significant impact on their organizations, a 5% increase1 from 2024. While an increasing number of CISOs report feeling a significant impact from AI threats, more than 60% now say that they are adequately prepared to defend against these threats, an increase of nearly 15% year-over-year. However, insufficient AI knowledge and skills and a shortage of personnel and talent continue to be listed as the two top inhibitors to a successful defense. Read Now

Most   Popular

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.