That's correct. HTML5 exposes
getUserMedia API to access media resources on the host.
See here for a reference implementation. This is the code in action: https://webaudiodemos.appspot.com/input/index.html
In terms of what the spec say about the security, quoting from this website:
Some browsers throw up an infobar upon calling getUserMedia(), which gives users the option to grant or deny access to their camera/mic. The spec unfortunately is very quiet when it comes to security.
Permission dialog in Chrome:
If your app is running from SSL (https://), this permission will be persistent. That is, users won't have to grant/deny access every time.
This is the issue to implement permission support in the spec itself: https://github.com/w3c/permissions/issues/62
However in practice, all standard browsers ask for permission via a popup box (or a infobar) before accessing the media resources. Hence, so far as one is using a modern browser, it should ask for permission.
If one is using a non-standard browser, modified version of chromium shell, or desktop based electronjs/nwjs apps, then it could be possible that the browser doesn't ask for permission, but again in such a case all other security gaurantees that modern browsers provide (eg. XSS auditor, CORS, Same origin policy etc.) goes for a toss.