Zoom flaws let attackers hijack devices via screen sharing

Security researchers at A Security disclosed vulnerabilities in Zoom’s video conferencing platform on August 12, 2026 that could have allowed attackers to silently hijack devices during screen-sharing calls.

The flaws affected all operating systems Zoom supports—Windows, macOS, Linux, iOS, and Android—and required no interaction from the victim.

They resided in the protocol for real-time annotation during screen sharing, an obscure feature that A Security’s AI bug-hunting systems targeted because convoluted functions often hide flaws in closed-source software.

A Security said the bugs were discovered in early June 2026 using publicly available AI models, with fewer than 20 prompts needed to develop a working attack.

Zoom issued a security advisory the same day detailing server and client-side fixes that the company has begun rolling out. Zoom did not respond to requests for comment.

Cofounder Omer Gull warned that the democratization of AI capabilities is dangerous because the barrier to entry is dropping rapidly.

Another cofounder, Yossi Torati, said an attacker could take over an enterprise by joining a call, seizing a computer and credentials, and moving laterally within the organization.

The researchers noted that Zoom users inherently trust the platform, often lowering their guard during personal, professional, and public events like webinars. Although the bugs are patched, the incident highlights an accelerating race as AI bug hunting proliferates.