diff --git a/ios/chrome/browser/reader_mode/model/reader_mode_web_state_delegate.mm b/ios/chrome/browser/reader_mode/model/reader_mode_web_state_delegate.mm
--- a/ios/chrome/browser/reader_mode/model/reader_mode_web_state_delegate.mm
+++ b/ios/chrome/browser/reader_mode/model/reader_mode_web_state_delegate.mm
@@ -66,8 +66,12 @@ void ReaderModeWebStateDelegate::OnAuthRequired(
 void ReaderModeWebStateDelegate::HandlePermissionsDecisionRequest(
     web::WebState* source,
     NSArray<NSNumber*>* permissions,
     web::WebStatePermissionDecisionHandler handler) {
-  handler(web::PermissionDecisionShowDefaultPrompt);
+  // Distilled content is attacker-derived HTML loaded at the original page's
+  // origin with no CSP; it must not be able to request camera/microphone at
+  // all, and certainly not via a path that skips the supervised-user check in
+  // WebStateDelegateBrowserAgent::HandlePermissionsDecisionRequest.
+  handler(web::PermissionDecisionDeny);
 }

 void ReaderModeWebStateDelegate::ContextMenuConfiguration(