CVE-2026-92299: @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using @jitsi/electron-sdk versions earlier than 10.0.5 are affected. The exposed functionality is available to scripts running in the meeting page.
What does an attacker need to exploit this?
An attacker needs the ability to run script in the meeting page. No authentication, active screen-sharing picker, user consent, or operating-system permission prompt is required for the described IPC call.
What can an attacker obtain?
An attacker can invoke the jitsi-screen-sharing-get-sources IPC route to enumerate available screens and windows and retrieve their desktop thumbnails. The thumbnails can be requested at arbitrary resolution.
How can I determine whether an instance is vulnerable?
Check the installed @jitsi/electron-sdk version. Versions before 10.0.5 are affected; the issue is addressed by moving to 10.0.5 or later.