macOS troubleshooting
Which app is using your Mac's microphone?
Updated 2026-07-23
When the orange dot appears in your Mac's menu bar, macOS is telling you some app is using the microphone - but not which one. Click Control Center (the two toggles icon, top right) and the app's name appears at the top. If Control Center is vague or the app has quit, the Terminal method below asks CoreAudio directly and names the exact process.
Method 1: Control Center (fastest)
- 1
Look for the orange dot in the menu bar - it means the mic is live.
- 2
Click the Control Center icon (two toggle switches, top-right).
- 3
The app using the microphone is listed at the top, e.g. 'Google Chrome is using the microphone'.
Method 2: System Settings history
- 1
Open System Settings > Privacy & Security > Microphone.
- 2
This lists every app that HAS permission - useful for auditing, but it doesn't show which one is live right now.
- 3
Revoke anything you don't recognize; apps ask again the next time they need the mic.
Method 3: Ask CoreAudio in Terminal (names the exact process)
macOS 14.2+ tracks audio per process. This command lists processes with the mic open:
ioreg -c AppleHDAEngineInput | grep -i engine shows hardware engines, but the more precise route is sudo lsof | grep -i 'coreaudio' - look for the process name in the first column. Chrome shows up as 'Google Chrome Helper', Zoom as 'zoom.us'.
Browser calls are the classic confusion: Google Meet in Chrome captures through 'Google Chrome Helper', not a process called Meet - so an unfamiliar Helper process with the mic open is usually just a browser tab in a call.
Mystery processes: avconferenced, corespeechd
avconferenced is Apple's own conferencing daemon - FaceTime, SharePlay and Continuity Camera use it. Seeing it during a FaceTime call is normal.
corespeechd powers Siri and dictation. If it holds the mic while you're not dictating, toggle Siri off and on in System Settings.
Frequently asked
Why is the orange dot on when no app is open?
A background process still holds the mic. Menu-bar apps, browser tabs in closed windows, and dictation are the usual causes. The Control Center method shows the name; quitting that app clears the dot.
Does the orange dot mean I'm being recorded?
It means an app has an active input stream from the mic. Whether audio is stored or transmitted depends on the app. macOS shows the indicator any time the stream is open, recording or not.
Can malware use the mic without the orange dot?
On modern macOS the indicator is enforced at the system level and can't be suppressed by ordinary apps. Anything capable of hiding it would need a kernel-level compromise - possible in theory, not something a normal app can do.