One stray click to watch an image or video online, and the web could start watching you back.

On Thursday Russian security consultant Egor Homakov published a proof-of-concept exploit that allows anyone to hide a script inside a clickable image that can surreptitiously activate any Google Chrome user’s webcam and photograph them. According to Homakov, the sneaky webcam spying trick, first discovered by another Russian hacker, uses a bug in Flash of which Adobe has been aware for two years. But that bug apparently still hasn’t been fixed, at least for users of Google’s browser.