Browser permissions are a continuing access decision, not a one-time popup to dismiss quickly. A site may request camera, microphone, location, notifications, clipboard access, motion sensors, MIDI, or other capabilities. The safest default is least privilege: grant only what the feature needs, for only as long as it needs it.
Start with the browser’s site-permission list
Open the browser’s privacy or site-settings area and review permissions by category and by site. Browser wording differs, but the useful questions are the same: which sites are allowed, which are blocked, which can ask again, and which grants were intended to be temporary.
| Permission | Legitimate use | Audit question |
|---|---|---|
| Camera | Video calls, scanning, webcam tests | Does this site need future camera access? |
| Microphone | Calls, recording, voice input | Was access granted to the correct origin? |
| Location | Maps, local services, device recovery | Can approximate location or manual entry replace persistent access? |
| Notifications | Time-sensitive account or service updates | Does the site provide enough value to interrupt the device? |
| Clipboard | Explicit copy/paste workflows | Is the request tied to a user action? |
| Motion or sensors | Specialized web experiences | Is the capability necessary for the page’s stated purpose? |
Separate active use from persistent permission
Closing a tab should stop an active media stream when the page releases it, but a persistent permission may remain for the next visit. Conversely, revoking a browser permission may not change the operating system’s separate privacy controls. Review both layers when a camera, microphone, or location request behaves unexpectedly.
Audit by site
- Open the site from a normal browser window.
- Use the address-bar site information control to inspect current permissions.
- Remove access that is unrelated to the feature you are using.
- Reload the page and confirm the feature fails safely or asks again.
- Grant access only through an intentional user action.
- Stop the feature and confirm the browser’s camera or microphone indicator clears.
Audit browser extensions separately
Extensions can have broader access than ordinary sites, including access to page contents, browsing history, downloads, tabs, or all sites. Review the extension manager for permissions, site access, update history, and whether the extension is still needed. Remove unused extensions rather than leaving powerful access dormant.
Audit the operating system
Windows, macOS, Android, iOS, and Linux desktop environments can apply their own camera, microphone, location, and notification controls. A browser-level grant cannot override an operating-system denial, and an operating-system allowance does not mean every site should be trusted.
Permission-audit checklist
Review quarterly and after installing extensions
- Remove camera grants from sites that no longer need them.
- Remove microphone grants from sites that no longer need them.
- Reduce persistent location access.
- Remove low-value notification subscriptions.
- Review automatic downloads and pop-up permissions.
- Review extension access to all sites.
- Review operating-system privacy controls.
- Test camera and microphone indicators.
- Use separate profiles for work, personal, and higher-risk browsing when appropriate.
- Repeat the audit after a browser reset or migration.
Use Aerod tools as focused checks
The Browser Leak Test can explain observable browser and permission-related signals. The Online Webcam Test can confirm camera and microphone behavior after an intentional prompt. These tools do not replace the browser and operating system settings that control persistent access.
FAQ
Does clearing cookies revoke camera and microphone access?
Not reliably. Permission grants and site data are separate controls in many browsers. Review the browser’s site-permission settings directly.
Why does a site still have access after I close the tab?
A persistent grant may remain for future visits even though the active camera or microphone stream stops. Revoke the site permission if future access is not needed.
Can a browser page see every permission setting?
No. The Permissions API covers only supported permission names, and browser behavior differs. The browser’s settings interface remains the authoritative place to review grants.
Should I block every permission by default?
Use least privilege: grant access only when a feature needs it, prefer one-time access where available, and remove grants that no longer serve a purpose.