Zoom’s hidden web server on Macs
A website could switch on your Mac’s camera through Zoom’s local web server. Apple removed it. Check what your apps install.
This month a security researcher showed that Zoom’s Mac app installed a small web server on the computer. It let websites start a Zoom call instantly, and a malicious site could join you to a call with your camera on. The server stayed even after you deleted Zoom.
Zoom removed it in an update, and Apple pushed a silent update that removes it from Macs.
The wider lesson is about convenience features:
- Apps sometimes install helpers that keep running in the background, often to skip a click.
- Check what’s listening on your machine now and then, and question anything you don’t recognise.
- Turn off “join with video on” by default in meeting apps.
- Uninstalling an app doesn’t always remove everything it added.