Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92299@jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

High 7.4

In plain English

A high-severity missing authorization in @jitsi/electron-sdk from Jitsi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.5%top 58.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.

Affected products (as reported)

Vendor	Product	Versions
Jitsi	@jitsi/electron-sdk	0 – before 10.0.5

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

Pull Request #516 patch, issue-tracking
Patch Commit patch
Ungated SCREEN_SHARE_GET_SOURCES invoke route technical-description
Gated _getSources() in 10.0.5 technical-description
https://github.com/jitsi/jitsi-meet-electron-sdk product
VulnCheck Advisory: @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture third-party-advisory