Comment by iamleppert

The real flaw here is in WebRTC. WebRTC should be disabled by default, and behind a permissions dialog at least. Still, facebook could just disable chat or some feature and claim they need WebRTC and 99% of users would opt-in to it.