The State of State Machines
Summary: Project Zero's Natalie Silvanovich found that a logic bug in FaceTime's calling state machine, disclosed January 29, 2019, let an attacker force a call to connect and listen to the target's surroundings without the target's interaction. She then tested calling state machines in Signal, JioChat, Mocha, Google Duo, and Facebook Messenger, finding similar consent-bypass flaws that let calls transmit audio or video without the callee answering.
Why it matters: In each case the failure was not memory corruption but a state machine that gated audio and video transmission on something other than adding or enabling tracks, so a caller could reach a target's microphone or camera with no user interaction at all.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026