CVE-2026-92299 Details
Description
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.
A vulnerability in the Jitsi Electron SDK, specifically in versions prior to 10.0.5, allows for unauthorized screen capture. The issue arises because the SDK exposes the 'getDesktopSources()' function via the context bridge without requiring an active 'getDisplayMedia()' picker. This oversight enables any script on the meeting page to enumerate screens and windows. Attackers can exploit this by calling the 'jitsi-screen-sharing-get-sources' IPC route to retrieve desktop thumbnails at arbitrary resolutions, all without user consent or operating system permission prompts.
Users can upgrade to Jitsi Electron SDK version 10.0.5 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jitsi Electron SDK | >= 0, < 10.0.5 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |