Apple pushes silent Mac update to remove the hidden web server in the Zoom app that could let websites add a user to a video call without their permission
Apple has released a silent update for Mac users removing a vulnerable component in Zoom, the popular video conferencing app …
Context & Ripple Effects
The disclosure came first: a researcher showed that any malicious website could force a Mac user into a Zoom call with the camera on via a zero-day exploit in Zoom's Mac client, and Zoom initially refused to patch it before backlash forced a fix. Apple's move here goes one layer deeper — rather than waiting on Zoom, it used its own silent macOS update channel to strip out the hidden web server Zoom had installed that made the attack possible.
That choice matters because it sets a precedent for how platform owners handle third-party apps that undermine system security: Apple didn't just notify or pressure Zoom, it removed the vulnerable component itself. The follow-on coverage shows this wasn't a one-off — days later Apple sent another silent macOS update covering webcam exposure in apps built on Zoom's tech like RingCentral and Zhumu.
First-order effects
- Mac users running Zoom immediately lose the hidden local web server that any website could hit to join them to a call without consent — the attack surface disclosed by the researcher is closed at the OS level, not just patched in the app.
- Zoom's own fix becomes secondary: Apple has demonstrated it can remediate a third-party app's security hole unilaterally, leaving Zoom to manage the reputational fallout of having installed an undeclared server in the first place.
Second-order effects
- Vendors building on Zoom's SDK — RingCentral and Zhumu per the follow-up coverage — inherit the same vulnerability class and now depend on Apple's update cadence rather than their own for remediation.
- Every developer shipping helper services or local servers inside Mac apps faces a new baseline risk: if the component undermines user control, the platform owner may delete it without coordination, raising the cost of undocumented background machinery.
Third-order effects
- If silent platform-level removals become the norm, security authority on the Mac consolidates further around Apple, with third-party apps effectively on notice that user-consent boundaries are enforced from above — a pattern the later Wardle-found auto-update root flaw suggests kept recurring as Zoom's Mac engineering stayed under scrutiny.
The trend: Platform owners are increasingly willing to bypass vendors and silently excise third-party components that break user-consent boundaries, making OS-level enforcement the final backstop for app security.