Did you see the same video as I? The current implementation is obviously very wrong. You press the button to stop the listening and the listening continues(!) and the browser doesn't even give any visual cue that it's still listening.

It's the Google answer that is suspect: 'there was an ongoing discussion within the Standards group, to agree on the correct behaviour - "Nothing is decided yet."' What, what?

I find it quite reasonable to expect that all window belonging to the same domain would stop listening to speech once the user indicates she wants recognition to stop. the main window, which started the speech recognition, indicated that the listening stopped, yet it continued on a spawned window. is it a bug? not sure. but it definitely could lead to some bad UX, even if the window isn't spawned as a fishy popunder.

I sure hope it's not a bug, I can imagine real world applications where this feature would be useful. There are two obvious issues here.

1. the video presented this in a very biased light the popup was already open and behind as the main window.

2. chrome should provide an indicator in a more global way to indicate a recording is taking place...

additionally, just like the camera on your computer lights up when it's on, it would make sense for your computer to have a similar light indicator for when the mic is on?

I've experienced pop-ups occurring that go behind. It's not like you don't notice it or anything though. Should this be considered a chrome security flaw? You did, after-all, grant privileges to that site. Revoke and report the site?

I would say yes. Pop-unders should be blocked, and modern browsers work pretty hard to, but it is often viewed as a "low priority" sec issue, and so workarounds are found, ignored, used in the wild, and patched. Here is one implementation, I have seen working versions up to Chrome ~30:

https://github.com/tuki/js-popunder

Another serious security issue is when the popunder waits for a while as the parent frame navigates itself to e.g. "java.com", then the child navigates the parent to a malicious drive-by download. This can make it appear to "spoof" a drive-by download. This attack vector has been known and ignored forever (I think Zalewski published about this years back). IE9 and 10 actually do a good job preventing this, but I know it works in most modern browsers.

The problem is that you don't expect a pop-under to continue collecting information from you, especially when you intended to close the connection!