How Safe Exam Browser (SEB) Detects Cheating — and Its Limits
Safe Exam Browser (SEB) is the strictest of the browser-based lockdowns — it takes over your whole screen and blocks other apps. But it's still a user-space Windows application, and that fact defines exactly what it can and cannot see.
What SEB locks down
When an exam launches SEB, it enforces a kiosk-style lockdown:
- Full-screen kiosk mode — you can't minimise, alt-tab, or reach the desktop.
- Blocked shortcuts — Alt+Tab, Windows key, Print Screen, task switching and right-click are disabled.
- Process blocklist — SEB checks for known screen-sharing, remote-access and VM tools, and refuses to start (or quits the exam) if it finds them.
- Configured URL whitelist — only the exam site is reachable.
- Clipboard clearing — copy-paste from outside is blocked.
What SEB checks for in running processes
SEB maintains a list of prohibited process names and window titles — things like OBS, TeamViewer, common VMs, and known helper tools. Before and during the exam it enumerates running processes and open windows and matches them against that list. If it finds a match, it blocks the exam.
The key limitation: this is a signature match against known names. SEB is not analysing behaviour — it's looking for a list of specific processes and window titles it already knows about. A process with no window, no taskbar entry, and no recognised name doesn't match anything on the list.
SEB's architectural blind spots
Because SEB is itself a normal Windows application (not a kernel driver or hypervisor), it can't see below or around itself:
- It can't stop a native app that started before SEB and draws directly to the screen without a normal window.
- It can't detect hardware-level keyboard input — to the exam field, injected keystrokes are indistinguishable from typing.
- It doesn't record your webcam by itself — that only happens when the exam pairs SEB with a separate proctoring service.
This is why heavy Electron tools get caught (they show up as a ~400MB named process with a window) while a tiny native overlay does not — the difference is entirely about matching SEB's process and window signatures.
Why UFOlee survives SEB when other tools don't
UFOlee is a ~450KB native Win32 binary with no window, no taskbar icon and no recognised process signature — nothing for SEB's blocklist to match — and it types answers with hardware keystrokes SEB can't distinguish from a person.
See how UFOlee works with SEBFAQ
Does Safe Exam Browser record your screen or webcam?
Not by itself. SEB is a lockdown browser. Screen or webcam recording only happens when the exam pairs SEB with a separate proctoring service like ProctorU or a webcam-AI add-on.
Can Safe Exam Browser detect other applications?
It can detect applications whose process names or window titles match its blocklist of known tools. It cannot detect an unknown native process that has no window and isn't on the list.
Why does SEB block some apps on launch?
SEB refuses to start if it finds a running process matching its prohibited list — screen recorders, remote-access tools and virtual machines are common triggers.