An AOL developer named Ran Bar-Zik has unearthed a disturbing flaw in Chrome that may make you rethink using Google’s web browser.
The issue revolves around a website’s ability to activate your camera and audio recorder. Google uses an API which legitimate developers call, that displays a distinctive red dot on the browser tab when the page in question activates your laptop’s camera and recording equipment (like it does when you activate a video call via a Google Hangout page, for example).
The problem is that this API is not required to be used, and an enterprising hacker can use malicious JavaScript to activate your camera without notifying you, and without any visible indication that the camera is on.