Zoom fixes vulnerability that let attackers fully take over other users' devices

Cybersecurity researchers have discovered a serious vulnerability in the Zoom Workspace app that allowed attackers to remotely gain full control of another person's computer or mobile device. The flaw affected the app across Windows, Mac, iOS, Android and Linux.

How the exploit worked

The vulnerability was located in Zoom's screen-sharing feature, specifically triggered when a call participant activates the annotation tool while sharing their screen. At that moment, attackers could remotely execute malicious code to gain access to the victim's device. No action was required from the victim, and the attack produced no visible warning, making it difficult to detect.

It is not yet known whether the vulnerability was ever exploited in real-world attacks.

Built with help from AI

The researchers who discovered the flaw managed to develop the exploit in under 24 hours using AI tools. In a blog post, the cybersecurity firm noted that this level of attack capability was previously limited to nation-state actors with large budgets and months of preparation, but a single researcher can now build a comparable exploit in a fraction of that time.

Zoom and Apple respond

Zoom was notified of the bug and has already rolled out fixes to address the threat, urging users to install the latest updates to stay protected. The vulnerability existed in all Zoom Workspace versions prior to the recent patches.

A similar issue recently emerged with Apple devices: a critical security flaw in macOS Screen Sharing allowed attackers on the same network to bypass authentication and gain access without valid credentials. Apple addressed the issue with updates to macOS 26.6.1, 15.7.9 and 14.8.9.