Zoom bug allowed silent device takeover on Android and iOS — now patched

Full text

TL;DR

A Zoom annotation flaw could let a malicious participant remotely take over another person’s device without any interaction.

Researchers found and exploited the bug using publicly available AI models in fewer than 20 prompts.

Zoom has patched the flaws, so updating the Zoom app is the most important thing you can do.

Over the past few months, we have watched frontier AI models rapidly alter the cybersecurity landscape — from AI models breaking technical barriers to mounting regulatory scrutiny over weaponized AI capabilities . Now, a newly disclosed Zoom flaw shows just how serious that can become.

Researchers used undisclosed publicly available AI models to uncover a vulnerability that could have allowed someone on a Zoom call to take control of another participant’s device. The flaw affected Zoom clients on Windows, macOS, Linux, iOS, and Android. Worse, the attack required no click, download, or other action from the victim. Simply being in the same meeting could be enough.