While I was using brave browser on my Windows PC, the yellow border that indicates that the screen is being recorded randomly popped up. I was using brave without any issues for a few hours before this randomly happened. It stayed like that for a few seconds until I closed brave. I didn’t press any shortcuts to initiate the screen recording, it started on it’s own.
Since it went away once brave was closed, my guess is that only brave was being recorded. I checked if there were any recordings in my video folders but I found nothing.
I opened the task manager and confirmed that no screen recording apps like OBS or Discord were running in the background. My nvidia game bar was completely disabled as well. And the only brave extension I have is freedownloadmenager which has nothing to do with it. I also went into my settings in “Privacy & security > Screenshot borders” and noticed that brave had access to this feature right around the time the yellow border appeared, even though I turned this feature off previously.
After that, I went into the event viewer to check if anything looked suspicious but I’m not really sure what to look for. I checked every event that was triggered arount that time online and everything seems normal.
Finally I scanned my computer with Hitman Pro, Malwerebytes (including rootkit scan), Windows Defender (deep scan) and Kaspersky Rescue Disk and found no threats.
I’m not sure if this is relevant but earlier today I replaced my Ram and I was messing around with the ram settings in my bios. But I don’t see how this could cause Brave to randomly start recording my screen.
I also saw a few posts on brave forums that brave was triggering screen recording notifications on MacOS but no mentions of Windows. Not sure if this is a known issue on windows as well.
Any idea what could cause this issue? Is it a bug or something more serious? What could I do to investigate further?
I don’t know how to reproduce this issue since it happened randomly without my input.
Did you test, by using Private Browsing? (On the chance, that might exclude such activity.)
Did you test, by DISABLING and REMOVING your lone extension (“freedownloadmenager”) ← that may “inadvertently” (or intentionally?) include some recording script?
I am otherwise very uncertain about what Microsoft Windows OS may do, other than the above and creating “snapshots” ← are some “snapshots” also activity recordings? ← I do not know.
I would create an additional Brave Browser user Profile and use it exclusively - for observation, testing; also for that test Profile, not adding any extension. Maybe also test by installing Brave Beta and not adding any extensions.
However I believe this has something to do with brave specifically.
I had two instances of brave open at the time of incident. One was my everyday profile with youtube open and the other one was a private browsing tab. I was using brave for a few hours without any issues before the border showed up. All of the windows related diagnostics and telemetry is off on my system so that shouldn’t be triggering the screen recording border. I tested a few other apps like OBS and Discord and neither of them trigger the yellow border to show up when the screen is being recorded or shared.
This has something to do with Brave.
When I go to my windows settings under Privacy & Security > Screenshot borders, I can see that Brave accessed it right around the time the border popped up on my screen.
Like I said, I completely scanned my computer using multiple AV’s and found nothing.
I also removed the brave extension just in case and will test if it happens again. This is the first time it happened and only lasted for a few seconds until I closed brave. Since then I’ve been testing it for a couple of hours now but everything seems normal.
My concern is the privacy and security of Brave. I’m not sure if it’s a bug or what, but brave accessed the windows screen recording API. How can it initiate a screen recording without any user input or notification. The yellow border is a windows security feature that warns the user that a program is accessing one of windows screen recording API’s and that the screen is being recorded. Without that, I wouldn’t even notice my screen was being recorded.