HTML5 has a provision ( getUserMedia / Stream API ) for accessing the user's webcam and has for some time (supported for at least 2 years in Chrome and quite a long time in Firefox as well).
This feature ("Loop") leverages this existing functionality along with WebRTC (a web standard for peer-to-peer real-time streaming between browsers) to create a video chat solution.
So, there's no new avenue / attack vector by which a nefarious site could hijack your webcam, as far as I know.
The Stream API has required a user affirmation to activate the webcam and mic in both Chrome and Firefox since its introduction.
Yeah, it would take a browser vulnerability for sites to just take control without the user accepting access to the camera. In chrome, there isn't even a way for you to accept camera access indefinitely to non-https sites. You will be prompted each and every time.
This feature ("Loop") leverages this existing functionality along with WebRTC (a web standard for peer-to-peer real-time streaming between browsers) to create a video chat solution.
So, there's no new avenue / attack vector by which a nefarious site could hijack your webcam, as far as I know.
The Stream API has required a user affirmation to activate the webcam and mic in both Chrome and Firefox since its introduction.