Annotation

The annotation feature lets people in a video call draw marks like underlines, circles, or arrows directly on someone else's shared screen. Think of it like pointing at a presentation slide with your finger, except the marks appear right on the screen itself.

For this to work, whatever you draw has to appear on the other person's screen in real time. That requires a new channel for data to travel through — and if that channel isn't properly locked down, it can be abused to sneak in other commands disguised as drawing data. A simple action like leaving a scribble on someone's screen can, if the underlying design has a flaw, become a key that opens the door to their computer.

As one article put it: "The pathway in question was Zoom's 'annotation' feature." A common collaboration tool for drawing underlines or circles while looking at a shared screen together can, if it has a security flaw, turn into a channel for secretly executing commands on a meeting participant's device. It's easy to misread this as the feature itself being inherently dangerous — but the real issue was a flaw in how it was implemented, and that flaw has since been patched.