CVE-2021-29959

What it actually does

Authorization bypass allows a site with prior mic+camera permission to silently re-enable the camera after the user disables camera sharing, provided the microphone stream remains active.

Why it matters to the business

Users on affected systems face unexpected camera access by websites, increasing privacy risk and potential regulatory exposure; the issue affects widely deployed software with millions of downstream dependents and has remained unpatched in some distributions for years.

How an attack unfolds

A malicious site first obtains microphone and camera permission, keeps the microphone stream open, then disables camera sharing; while the mic is active the site re-enables the camera without triggering an additional permission prompt.

How to fix it

Upgrade trafficserver on Debian 11 and 12 to 8.1.1+ds-1.1 or later; for Firefox users upgrade to version 89 or newer. Apply vendor patches promptly given the 1931-day exposure window and stable but non-zero EPSS.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release; review browser permission settings and test that camera access prompts appear after explicit disable while a microphone stream is active.

Typical attack path

1. Obtain initial user consent for microphone and camera
2. Maintain an active microphone stream
3. Trigger the camera-disable UI action
4. Re-request camera access while the microphone remains live
5. Capture video without further user interaction or prompt

How to detect it

Review browser permission and media-stream logs for unexpected camera reactivation events while microphone streams remain open; correlate with web-request logs from sites previously granted both permissions.

What your security team should do

• Prioritize upgrade of all affected trafficserver and Firefox instances to the listed fixed versions
• Audit browser permission grants across the environment
• Monitor EPSS and KEV status for any future increase in exploit activity