Researcher discloses zero-day exploit in Zoom's Mac client that lets any malicious site force a user into a Zoom call with video enabled without user permission
A vulnerability in the Mac Zoom Client allows any malicious website to enable your camera without your permission.
Context & Ripple Effects
A researcher has published a zero-day in the Mac Zoom Client that lets any website spin up a Zoom call with the user's camera on, no prompt required — a direct bypass of macOS's permission model. What makes the disclosure sharper is that Zoom had already been told about the flaw and initially declined to fix it, only reversing course under public backlash before shipping a patch days later.
The blast radius extends past Zoom itself: because Zoom licenses its technology to other vendors, the same camera-activation flaw was later confirmed in software from RingCentral and Zhumu, turning one client bug into a supply-chain problem for every white-label deployment.
First-order effects
- Mac users running the Zoom Client are exposed right now: any site they visit can silently activate their camera by forcing them into a call, with no OS-level permission dialog standing in the way.
- Zoom is forced into an emergency patch cycle it had resisted, after its initial refusal to fix drew enough backlash that it reversed course and shipped a fix within two days of disclosure.
Second-order effects
- Zoom's licensees inherit the liability wholesale — RingCentral and Zhumu's products carry the identical flaw, so each licensee now needs its own coordinated fix and customer communication for code it did not write.
- The disclosure invites researchers to keep auditing Zoom's client stack, and they do: within months the same Windows client is shown leaking login credentials via malicious chat links, extending the attack surface from camera access to credential theft.
Third-order effects
- If the pattern holds — a 2019 camera bypass followed by a 2022 auto-update flaw Patrick Wardle found that allowed root-level code execution — Zoom's client architecture itself becomes the recurring vulnerability class, pushing enterprise buyers to weigh vendor security track record alongside features when standardizing on meeting software.
- White-label licensing spreads single-vendor security failures across the industry: one flawed codebase means a fix-and-disclosure cadence set by Zoom dictates patch timelines for every company renting its technology.
The trend: Video conferencing clients are becoming a persistent local attack surface, where permission-model bypasses and update-chain flaws at one vendor propagate through licensing deals to the whole market.