diff --git a/src/org/thoughtcrime/securesms/WebxdcActivity.java b/src/org/thoughtcrime/securesms/WebxdcActivity.java
index f8f2a3593..99d2fbe7a 100644
--- a/src/org/thoughtcrime/securesms/WebxdcActivity.java
+++ b/src/org/thoughtcrime/securesms/WebxdcActivity.java
@@ -259,6 +259,7 @@ public class WebxdcActivity extends WebViewActivity implements DcEventCenter.DcE
         + "script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: ; "
         + "connect-src 'self' data: blob: ; "
         + "img-src 'self' data: blob: ; "
+        + "media-src 'self' data: blob: ;"
         + "webrtc 'block' ; "
       );
       headers.put("X-DNS-Prefetch-Control", "off");