# Security issue in WebRTC

**URL:** <https://devforum.zoom.us/t/security-issue-in-webrtc/79776>\
**Category:** Android\
**Created:** [December 5, 2022, 5:20pm UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776 "2022-12-05T17:20:03Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![dan1994](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dan1994/32/55368_2.png) [@dan1994](https://devforum.zoom.us/u/dan1994)\
**Post date:** [December 5, 2022, 5:20pm UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/1 "2022-12-05T17:20:03Z")

</div>

**Description**  
When we upload our app to the google play store, we see a warning about a security issue in the version of WebRTC used by our app (screenshot below). Our app doesn’t use WebRTC directly. We’re wondering if the meeting sdk uses WebRTC and if so whether or not the version could be updated such that it won’t have this security issue? Thanks!

**Which Android Meeting SDK version?**  
5.12.8

**Screenshots**

 ![Screen Shot 2022-11-28 at 7.06.40 AM](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/f/9/f9af19307fcbca7f9be5f5085e0076e4e7b3b2fd.png)

---

<div class="post-metadata">

**Author:** ![henrique](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/henrique/32/43615_2.png) [@henrique](https://devforum.zoom.us/u/henrique)\
**Post date:** [December 7, 2022, 10:37pm UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/2 "2022-12-07T22:37:31Z")

</div>

Amazon Chime SDK had the same issue. They recently released a new version of their SDK with updated WebRTC. I wonder if Zoom should do the same…

> <https://github.com/aws/amazon-chime-sdk-android/issues/513#issuecomment-1338292670>
>
> \<img width="1277" alt="Screenshot 2022-10-26 at 1 59 31 PM" src="https://user-im…ages.githubusercontent.com/57893099/198032439-bc10c4f5-1632-40ff-8966-6ace6b480dc7.png"\>
> 
> Am getting this error message after uploading my app to PlayStore
> 
> Vulnerable WebRTC Versions
> Your app uses a bad version of WebRTC, which contains security vulnerabilities.
> 
> implementation 'software.aws.chimesdk:amazon-chime-sdk-media:0.17.8'
> implementation 'software.aws.chimesdk:amazon-chime-sdk:0.17.7'

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [January 7, 2023, 8:37am UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/3 "2023-01-07T08:37:40Z")

</div>

Closed on January 7, 2023, 8:37am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\
**Post date:** [January 18, 2023, 8:02pm UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/4 "2023-01-18T20:02:59Z")

</div>

@dan1994, @henrique,

Thank you for posting in the Developer Forum and apologies for the missed response. We just wanted to follow up on this thread and report our engineers are looking into this. We have not seen similar reports but want to be proactive. In the meantime, can you share if you are still facing issues submitting/publishing the app on the Play Store?

---

<div class="post-metadata">

**Author:** ![carson.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/carson.zoom/32/785_2.png) [@carson.zoom](https://devforum.zoom.us/u/carson.zoom)\
**Post date:** [January 19, 2023, 7:23pm UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/5 "2023-01-19T19:23:34Z")

</div>

Opened on January 19, 2023, 7:23pm UTC



---

<div class="post-metadata">

**Author:** ![carson.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/carson.zoom/32/785_2.png) [@carson.zoom](https://devforum.zoom.us/u/carson.zoom)\
**Post date:** [January 21, 2023, 1:40am UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/6 "2023-01-21T01:40:20Z")

</div>

Hi @dan1994 @henrique ,

Thanks for the info. We are actively investigating internally. I would like to get additional info if possible:

- Is this Google Playstore completely blocking you from publishing new app because of this, or is this a warning that Playstore shows but it does not block the app publishing?
- Does Google Playstore provide any methods that you could submit a claim and provide evidence for review?

Looking forward to hearing from you!  
Thank you!

---

<div class="post-metadata">

**Author:** ![dan1994](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dan1994/32/55368_2.png) [@dan1994](https://devforum.zoom.us/u/dan1994)\
**Post date:** [January 21, 2023, 2:08am UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/7 "2023-01-21T02:08:18Z")

</div>

Hi @carson.zoom ,

Thanks for the reply. For the first question, it doesn’t block us from publishing our app. It’s just a warning. Although instead of being in the usual “Warnings” section it is in the “Errors” section. If we click the “Learn more” button on the warning it takes us here [How to fix apps with bad WebRTC versions - Google Help](https://support.google.com/faqs/answer/12577537).

For the second question, I’m not quite understanding. What kind of claim would we be submitting?

Thanks!

---

<div class="post-metadata">

**Author:** ![dan1994](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dan1994/32/55368_2.png) [@dan1994](https://devforum.zoom.us/u/dan1994)\
**Post date:** [January 31, 2023, 4:56pm UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/8 "2023-01-31T16:56:18Z")

</div>

Hi @carson.zoom ,

I’m just following up to see if there’s any update on this. Thanks!

---

<div class="post-metadata">

**Author:** ![dan1994](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/dan1994/32/55368_2.png) [@dan1994](https://devforum.zoom.us/u/dan1994)\
**Post date:** [February 13, 2023, 4:51pm UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/9 "2023-02-13T16:51:09Z")

</div>

Hi @carson.zoom and @donte.zoom ,

I’m just following up to see if there’s any update on this. Thanks!

---

<div class="post-metadata">

**Author:** ![donte.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/donte.zoom/32/24412_2.png) [@donte.zoom](https://devforum.zoom.us/u/donte.zoom)\
**Post date:** [February 13, 2023, 4:57pm UTC](https://devforum.zoom.us/t/security-issue-in-webrtc/79776/10 "2023-02-13T16:57:53Z")

</div>

Hi, @dan1994,

Thanks for following up! There is no update on this matter, however, we will keep you posted on any developments.
