Israeli security expert Guy Aharonovsky has discovered a vulnerability in an old version of Google Chromethat could be exploited to track users. The vulnerability can be used to intercept the speech transcript produced by the browser when the user uses the API. The researcher developed an online game to demonstrate the vulnerability.
The vulnerable API was introduced alongside the release of Chrome 11. Google has since released a newer version of the application, but Aharonovsky believes there are several websites still using the old application.
To prove his findings, the expert created a website that appears to be a simple game. Potential victims are asked to plant tree seeds and as the trees grow, they can make wishes, which they must dictate into the computer's microphone.
Users are unaware, however, that their wishes are being recorded by the attacker, as the speech recognition feature is activated every time they click on the screen.
“This is enough for someone to listen to the user’s speech, without permission and without providing any indication.”
Aharonovsky told IBTimes that Google has been made aware of the issue, but considers the bug to be "low severity" and does not see it as a top priority.
This isn't the first time experts have shown how Google's speech recognition app can be abused. Earlier this year, researcher Tal Ater demonstrated that the feature that allows users to perform searches in Google Chrome by dictating what they're looking for can be used to spy on their private conversations.
Below you can see the video posted by Guy Aharonovsky. Additional details about the API speech recognition vulnerability are available on the 's blog .
