Loading story…
Microsoft is testing new Windows 11 privacy controls that let users allow or block individual Win32 desktop applications from accessing the camera, microphone, location, and in some reports voice activation. The feature appeared in Windows 11 Insider Preview Build 26340.9212 for version 26H2 in the Experimental channel, where desktop apps can now trigger system permission prompts for camera and microphone access instead of relying on the long-standing shared device-wide toggles used for traditional Win32 software.
The controls were not documented in Microsoft's release notes and were first spotted by community testers, with reports indicating the rollout is limited to a subset of Insider systems and may be tied to the Win32SignatureIdentity feature flag. If broadly released, the change would close a notable privacy gap between classic desktop programs and Microsoft Store apps, while the same test build also completes removal of the legacy WMIC command-line tool, a utility frequently abused by ransomware operators during post-compromise activity.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
X user Jakub (@jakub25050) discovered and shared screenshots showing that build 26340.9212 lets users revoke camera and microphone access for specific Win32 desktop apps. His report helped reveal the feature because Microsoft had not documented it in release notes.
Microsoft released Windows 11 Experimental/Insider build 26340.9212 to the Experimental channel, where the new Win32 per-app privacy controls surfaced. The same build also finalized removal of the legacy WMIC command-line tool.
WindowsLatest verified on an Experimental Insider PC that Windows 11 build 26340.9212 exposes separate privacy entries for desktop apps and prompts for microphone and camera access. The outlet reported the feature covers camera, microphone, and location permissions and appears to be rolling out inconsistently.
According to Windows researcher Rafael Rivera, desktop apps had been listed collectively under the shared privacy switch since Windows 10 version 1903, without individual per-app controls.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
ghacks.net
Open sourcewindowslatest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft is preparing Windows 11 26H2 as a stability-focused release delivered through its continuous-innovation and shared-servicing model. Windows 11 24H2, 25H2, and 26H2 share a codebase, fixes, and testing; eligible 24H2 and 25H2 devices are expected to move to 26H2 through a small enablement package, while older releases such as 23H2 require a full feature update. Features can be staged in a disabled state through cumulative updates and activated later, reducing the compatibility risk associated with major branch upgrades. In Windows 11 Insider Experimental Preview Build `26340.9233` for 26H2, Microsoft is testing granular camera, microphone, and precise-location permissions for individual traditional desktop applications. The controls, available under **Settings > Privacy & security**, replace the prior device-wide model for these apps and support Microsoft’s Baseline Security Mode and user-consent initiatives. Microsoft cautioned that applications may appear under alternate or unsigned names because of shared components or browser-hosted technologies; the changes are being deployed through Controlled Feature Rollout and are not guaranteed to reach general availability.
Aug 30, 2026
Microsoft detailed two Windows security initiatives—**Windows Baseline Security Mode** and **User Transparency and Consent**—aimed at making Windows 11 behave more like mobile platforms in how it gates access to sensitive resources. Under *User Transparency and Consent*, Windows will prompt users when applications request access to protected data and device features (e.g., files, camera, microphone) and when installers attempt to add additional software; decisions will be recorded so users can review and change permissions later, including revoking previously granted access. *Windows Baseline Security Mode* is intended to enable runtime integrity safeguards by default, allowing only properly signed applications, services, and drivers to run while still permitting user/IT-admin exceptions for operational needs. Microsoft positioned the changes under its **Secure Future Initiative** and aligned them with the *Windows Resiliency Initiative*, noting a phased rollout in partnership with developers and enterprises and building on prior controls such as *Smart App Control* and administrator protection.
Jun 29, 2026
Google released the second beta of **Android 17** with new privacy-focused platform behaviors and APIs aimed at reducing unnecessary access to sensitive data. Changes include a system-level **Contacts Picker** that grants apps only temporary access to user-selected contacts (including across personal/work profiles), a new `ACCESS_LOCAL_NETWORK` runtime permission to control discovery/connection to LAN devices (with an alternative path via system-mediated device pickers), and expanded safeguards for SMS one-time passwords by delaying most apps’ programmatic access to OTP messages for three hours (with exemptions for default SMS and approved companion apps, and guidance to use SMS Retriever/SMS User Consent APIs). Microsoft is testing **Windows 11** security and performance improvements for batch/CMD script execution in Insider Preview builds by adding an optional “secure processing mode” that prevents batch files from being modified while running. Administrators can enable it via the `LockBatchFilesInUse` registry value under `HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor` or via the `LockBatchFilesWhenInUse` application manifest control, reducing repeated signature validation when code integrity is enabled. Separately, commentary on **Windows telemetry** reiterates that Microsoft collects diagnostic data and suggests users can inspect telemetry themselves, but it does not describe a specific new security incident or vulnerability disclosure.
Jun 29, 2026