---
id: CVE-2026-92299
title: >-
  @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via
  contextBridge without requiring an active getDisplayMedia() picker, allowing
  any script in the meeting page to enumerate screens and windows
summary: >-
  @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via
  contextBridge without requiring an active getDisplayMedia() picker, allowing
  any script in the meeting page to enumerate screens and windows. Attackers can
  call the jitsi-…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: Jitsi
product: '@jitsi/electron-sdk'
affected:
  - '@jitsi/electron-sdk < 10.0.5'
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:21:01.047'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92299'
references:
  - url: 'https://github.com/jitsi/jitsi-meet-electron-sdk'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jitsi/jitsi-meet-electron-sdk/blob/002dae740e63a225c0bc8ed7bd53ed7ce104ebc8/screensharing/main.js#L93-L96
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jitsi/jitsi-meet-electron-sdk/blob/v10.0.5/screensharing/main.js#L131-L137
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/jitsi/jitsi-meet-electron-sdk/commit/144080fdddad2d11f7380475d4ac9bcf379cd035
    label: disclosure@vulncheck.com
  - url: 'https://github.com/jitsi/jitsi-meet-electron-sdk/pull/516'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/jitsi-electron-sdk-before-10.0.5-unauthorized-screen-capture
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T18:40:41.566501Z'
ingestedAt: '2026-09-16T02:48:25.629Z'
epss: 0.00347
epssPercentile: 0.28364
---

## Overview

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.