Researcher discloses zero-day exploit in Zoom's Mac client that lets any malicious site force a user into a Zoom call with video enabled without user permission
“'A little less creepy' is still creepy.” Dan Goodin / Ars Technica : Zoom for Mac makes it too easy for hackers to access webcams. Here's what to do Nicole Nguyen / BuzzFeed News : The Zoom Desktop App Lets Any Website Take Over Your Mac's Camera. Here's What To Do About It. Luke Dormehl / Cult of Mac : Zoom rushes to fix its webcam-accessing flaw on Macs Emily Stewart / Vox : Hackers can hijack your Mac webcam with Zoom. Here's how to prevent it. Lily Hay Newman / Wired : A Zoom Flaw Gives Hackers Easy Access to Your Webcam Mikey Campbell / AppleInsider : Zoom to patch flaw that enabled access to Mac webcams Charlesarthur / The Overspill : Start Up No.1,107: Zoom's bad video plan, Marriott cops GDPR fine, Hollywood v Netflix … Stan Schroeder / Mashable : Zoom backtracks, fixes security vulnerability after user outcry Joseph Cox / VICE : Zoom Vulnerability Lets Hackers Hijack Your Webcam Michelle Cheng / Quartz : Zoom has reconsidered its response to a security flaw and is promising new fixes Duncan Riley / SiliconANGLE : Zoom fixes vulnerability that allowed hackers to hijack Mac webcams Danny Zepeda / iMore : Zoom vulnerability lets websites access your Mac's camera Evan Selleck / iDownloadBlog.com : Zoom responds to major vulnerability in Mac app that can allow sites to hijack webcam Abrar Al-Heeti / CNET : Zoom will patch videoconferencing app in security about-face Dark Reading : Zoom Client for Mac Exposing Users to Serious Risks Vinay Pidathala / Security Boulevard : How Isolation Mitigates The Zoom Vulnerability Graham Cluley : Zoom Mac flaw allows webcams to be hijacked - because they wanted to save you a click Tweets: Matt Haughey / @mathowie : This Zoom vulnerability is bananas. I tried one of the proof of concept links and got connected to three other randos also freaking out about it in real time. https://medium.com/... https://twitter.com/... Zoom / @zoom_us : This week, a researcher published an article raising a number of concerns about our video experience. We've published our response on our blog here: https://blog.zoom.us/... Kenn White / @kennwhite : “Update: Initially, we did not see the web server or video-on posture as significant risks to our customers [...] but in hearing the outcry from some of our users and the security community in the past 24 hours, we have decided to make the updates to our service” https://twitter.com/... Marco Rogers / @polotek : Zoom ignored this issue for months. One day after they got blown up on social media, a fix is deployed. I keep having people tell me “there's nothing we can do to influence these big companies” and I honestly don't know what the hell they're talking about. https://twitter.com/... @privacyproject : This week, @cwarzel explains why privacy issues rarely get fixed. “When invasive tools are baked deep into the infrastructure of our technologies, there's no easy solution.” https://www.nytimes.com/... Glenn Fleishman / @glennf : Zoom had a cascading failure of product decisions, security bypasses, and then a terrible hand-waving blog post—which has been updated several times, and they're finally doing the right thing. https://blog.zoom.us/... Jason Koebler / @jason_koebler : This vuln is really crazy ... primarily that Zoom was given 90 DAYS to fix it, didn't, and it's still active! Like, you can try it with a link in the story and I DID!!! https://www.vice.com/... Lorenzo Franceschi-Bicchierai / @lorenzofb : In the pursuit of fewer clicks, Zoom engineered its app to install a server on your Mac even if you uninstall the app, allowing it to turn on the camera on your Mac without you doing it. https://www.vice.com/... Marco Rogers / @polotek : Here is Zoom's official response. It's yet another case of “User's want the convenience so it's not a problem”. This is a poor response. This kind of stuff is enabled because user's aren't informed about they're being opted into. https://blog.zoom.us/... J-Strizzle / @jstrauss : In the meantime, $ZM stock is currently down <1% and still trading 5% higher than its July 3rd close. https://twitter.com/... Dieter Bohn / @backlon : @GoToMeeting Allowing users to set their video to on by default by joining is product choice I don't agree with, but understand. Allowing administrators to make that choice for users is a product choice is wrong IMO. https://blog.zoom.us/... https://twitter.com/... Dieter Bohn / @backlon : @GoToMeeting Overnight (for me, anyway), Zoom published a blog post response. Notable that Zoom says “We are not alone among video conferencing providers in implementing this solution.” WRT the web server on your Mac thing. https://blog.zoom.us/... @mikko : I don't see how this is relevant and I don't understand why Zoom mentions this in their statement. https://twitter.com/... https://twitter.com/... Thomas Fuchs / @thomasfuchs : Seriously if you have ever used Zoom on your Mac, even _if you uninstalled_ it, anyone can connect to your camera without you being prompted. Zoom didn't patch this even with 90-day heads-up time given by the security researcher. See the article for mitigation. https://twitter.com/... Joe Ferguson / @joepferguson : Don't *ever* let your marketing department publish a technical response. https://twitter.com/... Thomas Fuchs / @thomasfuchs : You really need to stop using Zoom (and uninstall it) right now. They literally don't know what they're doing. Completely PR-talk response without any real solution to severe security vulnerability (including taking video and audio of you and crashing your computer). https://twitter.com/... Rosyna Keller / @rosyna : Wait, so @zoom_us created a local web server with a new attack surface on Macs to get around a security feature introduced in Safari that prevented apps with custom URL schemes from being auto-launched behind the user's back?! https://blog.zoom.us/... Steve Troughton-Smith / @stroughtonsmith : Disasters like Zoom are why the Mac gets progressively more locked-down, and why commandline tools and daemons can't be exempt from signing & security. By default, we should trust no software, and neither should the hardware it runs on https://twitter.com/... @bascule : The flipside to responsible disclosure: failure to patch a critical vulnerability in 90 days makes a software vendor irresponsible and it's a good thing for their irresponsibility to become public knowledge sooner than later https://medium.com/...
Context & Ripple Effects
This disclosure is the opening move in what became a multi-year run of Zoom client security failures. The researcher showed that installing Zoom's Mac app left a local server that any website could invoke to force a call with the camera on — no click, no prompt. Zoom's first instinct was to argue the behavior was a feature, and only after sustained backlash did it ship a fix within days (reversing course and releasing a patch).
The reason this matters beyond one bug is architectural: Zoom licenses its client technology to other vendors, so the flaw wasn't contained to Zoom's own app — RingCentral and Zhumu builds inherited the same camera exposure a week later. That turned a single disclosure into a question about how widely one vendor's security debt propagates through white-label distribution.
First-order effects
- Mac users running Zoom have their cameras reachable by any malicious site until they apply the patch, and Zoom — which initially declined to treat it as a vulnerability — is forced into an emergency release under press and security-community pressure.
Second-order effects
- Licensees RingCentral and Zhumu must issue their own fixes for software they branded but didn't secure, exposing the cost of shipping another company's client stack; enterprise IT buyers start weighing Zoom's local-permission design against alternatives.
Third-order effects
- The pattern holds across platforms and years — the same Mac app later needed a fix for an auto-update flaw found by Patrick Wardle that allowed root-level code execution, and the Windows client was shown able to leak login credentials from chat links — pushing regulators and security researchers toward treating always-on helper services and bundled installers as standing attack surface rather than conveniences.
The trend: Video-conferencing clients are becoming a primary consumer attack surface, with researcher disclosures and licensee exposure forcing vendors to rebuild local permission handling as a security boundary.