0

Is it possible for Chrome extensions to monitor users without them knowing by taking screenshots and/or video?

There's an extension called Screencastify that allows you to record your screen. This particular extension (and many others) has a function that allows you to record your entire browser window. And here's the thing. When you set Screencastify to record the entire window, then go into Incognito mode, the browsing you do there gets recorded and saved. When you record the entire window, Chrome will show you a dialog box telling you that "Screencastify wants to share your screen," although it's not to hard to imagine a truly malicious extension bypassing this.

I personally think that this could be a privacy risk, as malicious developers and/or employers could secretly monitor Incognito and normal browsing activity without user knowledge.

Improve this question
3
  • Why do you believe a malicious extension would be able to bypass the warning from chrome?
    – vidarlo
    Commented Aug 16, 2019 at 23:05
  • I always assumed that the dialog/warning box was something developers could choose to trigger. @vidarlo
    – user214761
    Commented Aug 17, 2019 at 19:19
  • On a practical note, if a malicious JS dev or employer wanted to monitor employee activity, there are more practical forms of spyware than screenshot utilities. And also yes it's possible, as you've seen from the existence of the extensions. Fortunately they have to be installed/can be removed (usually), so you shouldn't be exposed to the risk by default.
    – belkarx
    Commented Feb 20, 2023 at 5:08

1 Answer 1

Reset to default
1

As it turns out, you were right being suspicious. The dialog showing up when the screen is being recorded isn’t optional, Chrome will always show it. But recording your webcam doesn’t bring up any such prompt. Or rather: recording your webcam requires a permission from the user, but it only needs to be given once, which typically happens immediately after installing the extension.

Due to the way Screencastify integrates with its website, any web page under the screencastify.com domain is capable of starting/stopping a webcam recording without producing any visual clues. And with the resulting videos being automatically uploaded to Google Drive, pages under screencastify.com can download this video. That’s another aspect of Screencastify’s website integration: the website has full read/write access to your Google Drive account.

Subdomains of the screencastify.com domain are being run not only by Screencastify themselves but also at least half a dozen third-party vendors, not counting hosting providers. All of them have this kind of potential access to your webcam. And anybody who can find a cross-site scripting vulnerability on any of these subdomains will get this access as well.

I came across your question while doing research for my article on this topic. You can read up on the details here: Hijacking webcams with Screencastify.

Improve this answer

You must log in to answer this question.