Why isn't the Windows client vulnerable? What have they/Microsoft done differently?
Zoom decided they know better than the Safari team and decided to install this local webserver specifically to bypass the operating system's security policies, supposedly because "it is their key differentiator" or whatever.
Basically their product managers decided they wanted it to work a certain way and demanded someone do whatever nasty hacks were necessary to make it happen.
It turns out their nasty hack doesn't set the proper CORS policy so any random webpage can force you to join a meeting.
It also turns out they don't do what mac apps are supposed to do: keep this crap inside the app bundle so dragging the app to the trash effectively uninstalls everything. Instead they install to ~/.zoomus, don't document that fact, and if you hit a zoom link after "uninstalling" they automatically reinstall themselves.
Oh and they let the registration for one of their domains expire and nearly lost control of it, which would make this a RCE because their client doesn't do anything to validate their update packages as far as anyone can tell.
I think that about covers it?
* Use `xar` to extract the contents of the .pkg file:
$ xar -xf Zoom.pkg
$ mkdir payload && cd payload
$ cpio -i -d < ../Scripts
$ 7zr x zm.7z
Importantly, note that the app will still exhibit the behavior discussed in the article. When you run it the first time, it will install ZoomOpener, which is the helper app that includes the web server. It will not install any browser extensions, however, which is the behavior I was originally trying to avoid by going through this procedure.