[CVE-2026-92299] @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an…

Descripción técnica

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.

Puntuación CVSS

Score: 7.4/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Debilidades (CWE)

CWE-862

Fuente oficial

Publicado en NIST NVD.