> While this bug does require the victim to click "open" on a popup from my website, it results in more than just multimedia permission hijacking. That's why I

> While this bug does require the victim to click "open" on a popup from my website, it results in more than just multimedia permission hijacking. That's why I'm so wary of browsers (well, a certain browser) adding more and more APIs that hide behind permission popups. People will blindly click them. And I fully agree with a sibling comment: "Writing a secure browser for today's web appears to be a technological challenge comparable to a level 5 self-driving car", https://news.ycombinator.com/item?id=30078738 https://news.ycombinator.com/item?id=30078738