How Camera and Microphone Permissions Can Be Silently Abused (abuse google meet permissions)

A responsible disclosure that Google's security team dismissed — and why users need to know about it anyway.

Have you ever wondered whether the following permissions can be abused if we grant them to Google Meet?

How Google Meet's Camera and Mic Permissions Can Be Silently Weaponized :

Now, how could this lead to abuse? Imagine opening a website that has embedded code like the code below, along with a meeting link hosted by an attacker :

Important NOTE :

When the code above runs, it opens a window in a hidden state, through which the attacker can use the permissions you have granted to watch you, take pictures, and listen to your audio without your knowledge.

I have repeatedly tried to demonstrate the impact of this issue to Google's security team, but they considered it low priority. So I thought I would publish it publicly to raise awareness, in case someone tries to carry out this kind of abuse, so that you can be aware of it.

Always pay attention to even the smallest windows that open on websites to avoid becoming a victim of malicious individuals.

In the image below, you can see a clear example of the attack. As simple as this, a vulnerability can be exploited through such a small window to gain access to the target's microphone and camera.

How to protect yourself

You don't need to abandon video calls to stay safe. A few simple habits close most of this gap:

1. Never check "remember for all microphones/cameras." Re-approving access each session is a minor inconvenience that completely neutralizes this attack vector.
2. Periodically audit your browser's site permissions. Chrome, Firefox, and Safari all let you view and revoke which domains have standing camera/mic access — clear out anything you don't actively use.
3. Watch for unexpected windows. If your cursor or focus seems to jump, or you notice an unfamiliar tiny window flash in your taskbar/dock, investigate before dismissing it.
4. Be cautious on unfamiliar sites before pressing common keys. This sounds unusual, but if you're on a page you don't fully trust, avoid reflexively pressing Enter/Space until you've looked at what's actually on screen.
5. Consider a hardware camera cover and a habit of muting your mic by default. Simple, physical safeguards remain some of the most reliable defenses against any software-based permission abuse.