Google Chrome 21 and getUserMedia API

Published: 2012-08-01
Last Updated: 2012-08-01 13:30:54 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

Google yesterday released Chrome 21, the latest version of Google's browser. In addition to the usual set of bug fixes (including some critical security patches), Chrome now joins Opera with support for the getUserMedia API.

getUserMedia is part of the larger HTML 5 ecosystem. HTML 5 includes not just new HTML tags. It is frequently used to represent a larger set of emerging standards for various browser APIs. getUserMedia will allow javascript to access microphones and cameras, something that hasn't been possible so far without special plugins. Usually Flash was used to collect images.

The getUserMedia API itself is part of "WebRTC". WebRTC ("Real Time Communication") will allow direct communication between browser. With WebRTC and getUserMedia, it will be possible to implement a video calling application using just HTML/Javascript without any plugins or other software.

From a security point of view, the critical problem is to protect the user from accidentally turning on the microphone and camera, or for a web application to turn it on without user permission. Google Chrome will show a warning message, asking the user for permission. Flash uses its own warning for this purpose, and has been subject to some clickjacking exploits that could be used to trick a user into giving it permission to use the camera/microphone.

This API has not been finalized yet. Expect changes, and bugs. Firefox will support it in version 16 (current . There is no word about support in Safari, but it is likely going to follow. If you wnat to experiment with it, see for details and a demo.

Problably the best list of supported features by browser can be found at

cmaera permission dialog in opera
Camera Permission Dialog in Opera

camera permission dialog in Chrome 
Camera Permission Dialog in Chrome

Johannes B. Ullrich, Ph.D.
SANS Technology Institute

Keywords: chrome google
1 comment(s)
ISC StormCast for Wednesday, August 1st 2012


Diary Archives