To keep it all in perspective, though, the user has to first intentionally enable the microphone at a misbehaving site which, itself, is the only site that can listen in thereafter, regardless of what site a user browses to in the session - provided the misbehaving site first creates a "keep alive" pop-under window behind the Chrome window (so as to hide its presence from the user). If the browser or the pop-under is closed, the exploit ceases. It's still a potentially harmful exploit, but certainly not as bad as if a site could auto-activate a user's mic or if any other site could listen in to a mic after it was somehow activated at a different site.