Chrome browser bug can let malicious sites eavesdrop - KMPH FOX 26 | Central San Joaquin Valley News Source

Chrome browser bug can let malicious sites eavesdrop

Updated: Jan 23, 2014 04:18 PM
Image courtesy of Google Image courtesy of Google


By Trevor Mogg
Provided by


If you're the kind of PC user who covers your machine's camera for fear of someone hacking into your computer and spying on you, you might want to stick something in the tiny mic hole as well – especially if Chrome is your browser of choice.

A NY Times report revealed that a web developer has found a way to listen through a computer's mic – even when the user thinks it's off – by exploiting a vulnerability in Google's browser.

The security flaw was uncovered by Tel Aviv-based developer Tal Ater while working on a tool that adds voice recognition functionality to websites.

In a blog post titled ‘Chrome bug allows sites to listen to your private conversations', Aviv explains how malicious websites can gain access to your mic and listen in on private conversations within earshot of your machine, "even after you've left those sites….as long as Chrome is still running."

In normal circumstances when using Chrome, a red marker appears on a tab when you give a website access to your mic. However, Ater's discovery shows that even when you think you've turned the mic off and the red indicator disappears, or you close the tab, a pop-under window that appeared when you granted the site access ensures that the mic remains active, capturing nearby audio for as long as the browser stays open.

According to a video (below) on Ater's site, the mic can also be "programmed to stay dormant and only start recording once you've said certain interesting keywords" – functionality that may well have NSA agents choking on their coffee in excitement when they find out.

The Web developer explained on his site that he reported the bug to Google's security team in September, after which they quickly acknowledged the issue. However, four months on, a fix still hasn't been released.

An unnamed source told the NY Times the Web giant decided not to issue a fix because "the voice recognition tool complies with Web standards," and instead the company is "working on better visual clues to show that access to the microphone has been given."

Although Ater says he has no knowledge of any hackers having taken advantage of the flaw, the general message here is for Web users to be sure that any site asking to access a machine's mic is legitimate.

With voice recognition software expected to gain much wider use in the coming years, Internet giants like Google and Apple will be keen to eliminate these kinds of issues in an effort to allay privacy concerns over such matters.

If you're a Chrome user and you'd like to check which sites currently have access to your machine's mic, take the following steps:

- Click on the Chrome menu at the top right of your browser

- Click on Settings

- Click on Show advanced settings at the bottom

- Click on Content settings under Privacy

- Click on Manage exceptions under Media (you'll need to scroll down a little way for this)

- If you've granted access to any sites in the past, they'll show up here.

This article was originally posted on Digital Trends

Content provided by
INFORMATIONAL DISCLAIMER The information contained on or provided through this site is intended for general consumer understanding and education only and is not intended to be and is not a substitute for professional financial or accounting advice. Always seek the advice of your accountant or other qualified personal finance advisor for answers to any related questions you may have. Use of this site and any information contained on or provided through this site is at your own risk and any information contained on or provided through this site is provided on an "as is" basis without any representations or warranties.
Powered by WorldNow
All content © Copyright 2000 - 2014 WorldNow and KMPH. All Rights Reserved.
For more information on this site, please read our Privacy Policy and Terms of Service.