Researcher: software from RingCentral and Zhumu, which license Zoom's tech, is affected by the same flaw in Zoom that could give attackers access to Mac cameras
Nicole Nguyen / BuzzFeed News :
Context & Ripple Effects
The arc here started with a researcher's zero-day disclosure showing any malicious website could force a Mac user into a video-enabled Zoom call without permission. Zoom initially declined to fix it, then reversed course under backlash and shipped a patch within days.
This report widens the blast radius: because RingCentral and Zhumu license Zoom's underlying technology, their own Mac software carries the same camera-access flaw — meaning users who never installed Zoom's client were still exposed. The next day, Apple responded with a silent macOS update covering apps built on Zoom's tech.
First-order effects
- RingCentral and Zhumu customers are exposed through software they chose as alternatives to Zoom, and both vendors must now ship their own fixes rather than rely on Zoom's patch.
- Zoom's licensing business becomes a liability channel: every partner embedding its technology inherits the same vulnerability and the same public scrutiny.
Second-order effects
- Apple is pulled in as patcher of last resort, pushing a silent macOS update to close the hole across all apps using Zoom's tech — an OS vendor cleaning up a third-party SDK problem.
- Other companies licensing Zoom's conferencing stack face pressure to audit and disclose whether their builds are affected before researchers or press do it for them.
Third-order effects
- White-label SDK distribution turns a single vendor's flaw into an industry-wide exposure class, where the security of many branded products rests on one upstream codebase.
- If the pattern holds, OS makers like Apple will keep absorbing remediation work for embedded-component vulnerabilities, shifting some accountability from app vendors toward platform owners.
The trend: Conferencing software is consolidating around licensed core technology, so one vendor's security failure propagates across every brand built on it, with OS vendors left doing the cleanup.