This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

Please see the following link for instructions on filing security bugs:
http://www.chromium.org/Home/chromium-security/reporting-security-bugs

NOTE: Security bugs are normally made public once a fix has been widely
deployed.

VULNERABILITY DETAILS
Please provide a brief explanation of the security issue.

VERSION
Chrome Version: Chrome 51
Operating System: All

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

Hey,

The official ChromeVox (80k users) Google Chrome extension, a screen reader for the visually impaired, does not cover Chrome's allow-access popups. This imposes a security risk for visually impaired people, because the default tab focus is set on "Allow".

If we set up a page that shows: "Please press enter to continue", it's all a visually impaired user will hear. Sounds legit - but in reality he's giving away access to his webcam and microphone. Users with a visual handicap probably won't see the other warning signs as fast (such as the webcam activation LED), which makes this particular group even more vulnerable to this type of attack.

Reproduction steps
1. Install ChromeVox here http://www.chromevox.com/
2. Navigate to https://inti.io/poc/blind​ and close your eyes
3. Follow the instructions read by ChromeVox (Please press enter)
4. Open your eyes
5. Your webcam image should appear


Fix

I believe you can either fix the extension to properly read the allow-access popups upon appearing. Setting the default tab to "Block" would also help.