Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Seriously, it specifically states that it can use the camera and audio recording any time it wants, whether or not I wish it to. Why is Chrome on Android requesting those permissions?

Should I be concerned?

enter image description here

(Emphasis my own.)

share|improve this question
Compared to all the other stuff Google already knows about you, it is like being concerned about a particular lava current while being inside a volcano. But, if I were you, I would just root my phone and install something like Permissions Denied or Pdroid. – Cerberus Apr 5 '13 at 16:36
That doesn't sounds like a good question for a stackexchange site. If you don't trust the company/software then don't use it. There are plenty of good and open source alternative browsers for Android. Otherwise you just have to trust that they don't mess around with their permissions. I think that Chrome is requesting the A/V permissions because of recent changes regarding Chrome and webRTC. – Flow Apr 5 '13 at 16:37
@Flow: OK, thought you were editing for style. Feel free to revert to yours. – Robusto Apr 5 '13 at 16:54
I thought the edit message was pretty clear :( – Flow Apr 5 '13 at 16:56
The lesson here is: Good developers include information about why their app is requesting the permissions it is. – Al E. Apr 5 '13 at 17:55
up vote 24 down vote accepted

The Chrome page in the app store says this about the new permissions:

This version requests two new permissions, Camera and Modify Audio Settings, to support WebRTC, an experimental feature under development.

WebRTC itself is designed to expose your camera and mic to the browser, so that web-apps can implement video-conferencing and other multimedia solutions in-browser.

The WebRTC people have at least nominally considered the privacy implications, by adding an info-bar to Chrome: enter image description here

Chrome on Windows is said to have access to your camera and mic. So if you use Chrome on Windows (and soon Firefox too) then you are implicitly trusting the vendor of those programs to not take pictures of you when you don't authorize it. The same is true for Android. One hopes that they don't introduce security flaws that allow unauthorized access to the camera/mic by malicious websites.

As to what you can do about it, on a rooted phone you can uninstall Chrome or install a permissions-control app that denies permissions to installed apps. You can switch to a different browser that doesn't support WebRTC. Otherwise you're stuck with what Android provides. If you decide that you trust Microsoft or Apple more than Google, you can switch. Or maybe you trust an open-source Android variant like Cyanogenmod. For myself I consider the fact that Google already has a bunch of apps on my phone which have access to my camera and mic, so if Google wanted to spy on me they already can. Heck, they could build that right into the OS and just not tell anyone.

Google Apps that can access the camera/mic:

Not to mention the camera app which is built-in to the phone.

Edit: The question was updated with a screenshot of what the phone shows when you are prompted to update the app. Unfortunately at this time there doesn't seem to be a way for app developers to document why they need particular permissions, except in external sources. For example, this Chrome update states why it needs the permission in the "What's New" page. However, if you don't look there and just see the scary warning, you are left wondering what is going on. As an app developer I wish we could add help text to the permissions page to explain to the user why we need the permissions and how the privacy policy protects the user. Google could certainly make this more usable and less scary.

share|improve this answer
+1 Thanks for a comprehensive answer. – Robusto Apr 5 '13 at 17:50
I don't really count the stock camera as a "Google app" since it is included in the AOSP and I can verify (by looking at its source) that it isn't doing anything malicious, unlike the rest of these google apps. Anywhoo thanks for the great answer =). – FoamyGuy Apr 5 '13 at 18:53
Great answer. I don't know why Android apps can't be a bit more dynamic in their permissions... WebRTC appears to be an extra (optional) feature that not everyone will use. Why can't permissions be requested at the time that extra feature is first activated, with perhaps just an advisory notice when the app is installed that more permissions are required in order to make full use of the app? I'm not an app developer, but I guess "it doesn't work like that"...? – w3dk Apr 6 '13 at 0:09
@Cerberus: Slight snag, on later Nexus devices Chrome is the stock browser. – w3dk Apr 6 '13 at 10:45
The idea about permissions on Android is that they can be distributed between different Manifests (apk's), which then can communicate between each other via IPC (Intents/Binder/...). Every apk can provide a given functionally with the permission(s) it has been granted. The user is then free to install a component of the app or not, which comes down to accepting a certain permission and getting the features the permission makes possible. But this approach is not very common with app developers. – Flow Apr 7 '13 at 15:15

protected by Community Nov 20 '13 at 19:28

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.