Webcam & Screen Recording Detection: How SecureLint Alerts You When a Site Activates Your Camera

Your laptop camera activates. The indicator light — if your device even has one — flickers on. Is it a legitimate video conferencing tool, or is it a web page that silently requested camera access while you were distracted? Most people would never know. SecureLint makes sure you always know exactly which site has activated your camera, microphone, or screen recording permission — and surfaces that information the instant it happens.

The silent camera activation problem

Chrome requires a user permission prompt the first time a site requests camera or microphone access — but that is the only gate. Once you have granted a site permission, it can:

• Reactivate the camera on every subsequent visit without prompting you again
• Start the camera stream in a background tab that is not currently visible
• Activate the microphone independently of the camera using the same previously-granted permission
• Request screen capture through the getDisplayMedia API — which does show a picker dialog, but only until the user selects a source, after which the stream runs silently

Malicious sites exploit this by requesting camera or microphone access under a legitimate-seeming pretense (a fake support chat, a fake online exam proctoring tool, a fake webcam test), then using the persistent permission to capture media on subsequent visits. The browser provides no persistent notification that a stream is active in a background tab.

How SecureLint detects camera and microphone activation

SecureLint monitors the browser's permissions API in real time. Specifically, it watches for:

• The camera permission state changing to granted on any page
• The microphone permission state changing to granted on any page
• Any page that holds both camera and microphone permissions simultaneously (strong meeting/surveillance signal)
• Camera or microphone activations on pages outside of the known video conferencing URL list (meets.google.com, zoom.us, teams.microsoft.com, etc.) — a potential indicator of surveillance-ware

The detection runs as a background service worker that polls permission states across all open tabs every 3 seconds. When a camera activation is detected, SecureLint fires a real-time notification within 3 seconds of the stream starting.

Screen recording and tab capture detection

Beyond the camera, SecureLint also monitors for screen and tab capture activity:

• Screen capture (getDisplayMedia) — Any page that successfully captures the screen, a window, or a tab is logged. SecureLint records the capturing page URL and the type of capture surface selected.
• Tab capture via extension API — Browser extensions can capture the content of any tab using the tabCapture API. SecureLint flags extensions that use this API and do not match known legitimate video conferencing tools.
• Invisible iframes capturing media — A technique where a hidden 0×0 pixel iframe requests camera access on behalf of a parent page. SecureLint flags camera activations from invisible or off-screen elements.

What the real-time alert shows

When SecureLint detects a camera, microphone, or screen recording activation, it fires a notification that includes:

• The activating page URL — The exact page that started the media stream
• The permission type — Camera, microphone, or screen recording
• Domain risk score — Whether the activating domain is trusted (known video conferencing tool) or suspicious (young domain, phishing category)
• One-click revoke — A button to immediately revoke the site's camera and microphone permissions without opening browser settings
• Timestamp and duration — When the stream started and how long it has been active

Enterprise camera access controls

SecureLint Enterprise admins can configure camera and microphone access policies:

• Camera access audit log — All camera activations across every employee browser are logged to the admin console with employee identity, activating URL, and duration
• Approved site list — Define a list of domains that are approved for camera access (e.g. meet.google.com, zoom.us). Activations outside this list generate a High severity detection event
• Auto-revoke on suspicious domains — For domains outside the approved list with a risk score above a configurable threshold, SecureLint automatically revokes camera permission without waiting for user action

Setting up webcam detection in SecureLint