New issue
Advanced search Search tips

Issue 650571 link

Starred by 1 user
Status: WontFix
Owner: ----
Closed: Sep 2016
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security:

Reported by pierrelo...@gmail.com, Sep 27 2016 
VERSION
Chrome Version: [53.0.2785.124] + [stable]
Operating System: [Android 5.1, security patch 2016-03-01]

Settings > Site settings > camera blocked option doesn't work, a webpage can access to the camera of the mobile phone without asking permission using only hmtl5 media capture API.

For instance, you can try it on: 

http://html5demo.braincracking.org/demo/mediaCapture.php

Comment 1 by kenrb@chromium.org, Sep 27 2016

Status: WontFix (was: Unconfirmed)

Thank you for the report.

Unfortunately it is hard to find good documentation on this, but the option you are looking affects direct camera access, not Android intents. Attempting to access the camera directly using getUserMedia() should still require explicit user permission. Media Capture API doesn't need this permission because it always requires user action in order for the site to get access to media -- it is effectively a special kind of file picker.

Comment 2 by pierrelo...@gmail.com, Sep 27 2016 

Thanks for the reply.
Project Member

Comment 3 by sheriffbot@chromium.org, Jan 4 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment