Unauthorized Silent Webcam Activation via Loom Chrome Extension Web Accessible Resources

Disclosed by
AlixSchaefer
  • Engagement Atlassian
  • Disclosed date 9 days ago
  • Reward $800
  • Priority P3 Bugcrowd's VRT priority rating
  • Status Resolved This vulnerability has been accepted and fixed
Summary by Atlassian

Broken Authentication Vulnerability in Loom Chrome Extension

Summary by AlixSchaefer

Unauthorized Silent Webcam Activation via Loom Chrome Extension Web Accessible Resources

Report details

  • Submitted

  • Target Location

    Loom Chrome Extension

  • Target category

    Other

  • VRT

    Broken Access Control (BAC) > Privilege Escalation

  • Priority

    P3
  • Bug URL
    chrome-extension://liecbddmkiiihnedobmlmillhodjkdmb/html/bubble.html
  • Description

    Summary

    Any website can silently activate a user's webcam by embedding the Loom Chrome Extension's bubble.html page in an iframe. This page is declared as a web_accessible_resource with matches: ["<all_urls>"], meaning any website can load it. Once camera permission has been granted to the extension (which happens during normal Loom usage), the webcam activates without any permission prompt when any website loads this iframe.

    Affected Component

    • Extension: Loom Chrome Extension v5.5.173 (ID: liecbddmkiiihnedobmlmillhodjkdmb)
    • File: manifest.json > web_accessible_resources > html/bubble.html
    • Installed by millions of users via Chrome Web Store.

    Prerequisites

    1. The Loom Chrome Extension is installed in Chrome
    2. The user has previously granted camera permission to the extension (this happens the first time the user records a Loom video -- standard usage)

    Steps to Reproduce

    Step 1 -- Create the attacker page. Save this HTML as /tmp/loom_poc.html:

    <!DOCTYPE html>
<html>
<head><title>Attacker Page</title></head>
<body style="background:#000;color:#fff;padding:20px">
<h1>Attacker-controlled website (localhost:9999)</h1>
<p>The iframe below loads Loom extension bubble.html:</p>
<iframe
  src="chrome-extension://liecbddmkiiihnedobmlmillhodjkdmb/html/bubble.html"
  width="400" height="400"
  allow="camera;microphone"
  style="border:3px solid red">
</iframe>
<p style="color:red;font-size:18px">If you see a live webcam feed above, the vulnerability is confirmed.</p>
</body>
</html>

    Step 2 -- Start a local web server (simulates the attacker's website):

    cd /tmp && python3 -m http.server 9999

    Step 3 -- Open http://localhost:9999/loom_poc.html in Google Chrome (with Loom extension installed).

    Step 4 -- Observe the result:

    • The iframe with the red border shows the LIVE webcam feed from the user's camera
    • The URL bar shows localhost:9999 (attacker site, NOT loom.com)
    • No camera permission prompt appears (permission was already granted to the extension during normal usage)
    • The webcam indicator light is ON

    This proves that any website can activate the user's webcam through the Loom extension without their knowledge or consent.

    Why This Works

    1. bubble.html is listed in manifest.json as a web_accessible_resource with matches: ["<all_urls>"]. Any website can load it in an iframe.
    2. When bubble.html loads, it connects to the extension's Redux store and initializes the camera preview automatically.
    3. Camera permission is granted to the chrome-extension:// origin, not to the embedding website. Once granted during normal Loom usage, it persists for ALL websites that embed the iframe.
    4. The result: any website loads bubble.html in an iframe, the webcam activates silently, and the live feed is visible in the attacker-controlled iframe.

    Security Impact

    Unauthorized hardware activation: Any website can activate the user's camera without consent. This is not a data exfiltration via JavaScript -- the same-origin policy blocks the attacker's JS from reading iframe pixels. The security impact operates at a different level:

    1. Privacy violation through unauthorized hardware access: Activating a user's webcam without informed consent violates user trust and privacy expectations. The user granted camera permission to Loom for recording, not to every website on the internet. This is an abuse of delegated permissions (CWE-862).

    2. Proximate attacker / shared screen scenarios: During screen sharing (Zoom, Teams, Google Meet), video calls, or presentations, the live webcam feed inside the hidden iframe is transmitted to all viewers. An attacker who sends a link during a video call can see the victim's camera feed through the shared screen.

    3. Screen-capture chaining: Any process with screen-capture ability (OS screenshot tools, screen recorders, remote desktop software, or another browser extension with tabs.captureVisibleTab permission) can exfiltrate the webcam feed. The Loom extension itself has display-capture permissions, creating a potential chain.

    4. Persistent hidden surveillance: With style="opacity:0;width:1px;height:1px", the iframe is invisible but the camera remains active for the entire duration of the user's visit. The attacker can keep the webcam running indefinitely.

    5. Extension state manipulation: bubble.html communicates with the extension's background service worker via Redux store. This interaction surface could allow an attacker page to influence extension state (trigger recording, change settings) through the extension's internal messaging.

    Regarding the camera LED: The hardware LED is a transparency mechanism, not a security control. It does not prevent unauthorized activation. Users with the Loom extension installed will naturally attribute camera activity to Loom. Additionally, an attacker can flash the camera briefly (1-2 seconds) then destroy the iframe, and many external monitors / USB cameras lack visible LEDs.

    Regarding intended functionality: The Loom bubble overlay is designed to appear when the user explicitly initiates a recording via the extension icon. In normal operation, the extension's content script injects bubble.html -- a trusted, user-initiated action. The vulnerability is that web_accessible_resources with matches: ["<all_urls>"] allows any website to load this page without user interaction. No origin check or handshake with the extension occurs before the camera initializes.

    Root Cause

    manifest.json declares sensitive pages as web_accessible_resources for all URLs:

    "web_accessible_resources": [{
  "resources": [
    "html/bubble.html",
    "html/pinnedTab.html",
    "html/permissionsCheck.html"
  ],
  "matches": ["<all_urls>"]
}]

    bubble.html should NOT be accessible to all URLs. It contains camera initialization code that executes automatically on load, with no verification that the load was initiated by the extension itself.

    Remediation

    1. Remove bubble.html, pinnedTab.html, and permissionsCheck.html from web_accessible_resources
    2. If web accessibility is required, restrict matches to ["https://www.loom.com/*"]
    3. Add a check in bubble.html to verify it was loaded by the extension's content script (e.g., via chrome.runtime.sendMessage handshake) before initializing the camera
    4. Add Content-Security-Policy: frame-ancestors 'self' to all extension HTML pages

    Proof

    Screenshot shows: localhost:9999 in URL bar + live webcam feed visible inside the red-bordered iframe, confirming that an attacker-controlled page activated the camera through the Loom extension.

    PREUVE_P1_FINALE.png

Activity