‘Zoomsday’ security flaw exposes new risk of screen sharing: What we know

Researchers from A Security uncovered a significant security flaw in Zoom’s screen-sharing feature that could enable hackers to take control of devices used by participants in a call. First discovered in June, this previously unknown vulnerability, labeled a zero-day flaw, could be exploited without any user interaction, such as clicking on a link.

The flaw was identified using an AI-powered bug hunting system that can probe complex software functions often overlooked during standard code reviews. Affected devices include Windows, macOS, Linux, iOS, and Android systems that support Zoom. The researchers were able to uncover the vulnerability and simulate a working cyber attack using fewer than 20 prompts to publicly available AI models.

Zoom has since issued a security advisory and patched the flaw on both the server and client sides, including applications running on customer devices. However, the researchers expressed concern over the ease with which a threat actor could exploit this zero-click flaw to hijack a target device simply by having a potential victim join a Zoom call.