CVE-2026-92299: Jitsi Electron SDK Information Disclosure

CVE-2026-92299 Overview

CVE-2026-92299 affects @jitsi/electron-sdk versions before 10.0.5. The SDK exposes getDesktopSources() through Electron's contextBridge without requiring an active getDisplayMedia() picker session. Any script running in the meeting page can invoke the jitsi-screen-sharing-get-sources IPC route to enumerate screens and windows. Attackers retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts. The weakness is classified as [CWE-862] Missing Authorization. It enables silent reconnaissance of a victim's desktop content from within an embedded or compromised meeting page.

Critical Impact
Any script in a Jitsi meeting page can silently capture desktop and window thumbnails without triggering user consent dialogs or operating system permission prompts.

Affected Products

@jitsi/electron-sdk versions prior to 10.0.5
Jitsi Meet Electron applications bundling the vulnerable SDK
Downstream Electron apps embedding the Jitsi meeting screensharing module

Discovery Timeline

2026-09-16 - CVE-2026-92299 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92299

Vulnerability Analysis

The vulnerability resides in the screensharing bridge of @jitsi/electron-sdk. The SDK registers an IPC handler named SCREEN_SHARE_GET_SOURCES (jitsi-screen-sharing-get-sources) that forwards renderer calls directly to Electron's desktopCapturer.getSources(). The handler validates the calling webContents owner but does not verify whether a user actually initiated a screen share. Because contextBridge exposes this route to the main world, any JavaScript executing in the meeting page reaches the handler. Malicious or injected scripts request full-resolution thumbnails of every open display and window. The captured images bypass the standard getDisplayMedia() picker, so neither the browser-style consent UI nor the operating system's screen recording permission dialog is shown to the user.

Root Cause

The root cause is missing authorization on a privileged IPC route. The pre-patch handler executed desktopCapturer.getSources(opts) unconditionally for the owning webContents. It never checked whether the user had opened the source picker or started a share. Requested thumbnail dimensions were also unbounded, allowing attackers to specify large sizes that produce high-fidelity captures.

Attack Vector

An attacker who controls script execution within a Jitsi meeting page invokes the exposed IPC route through the contextBridge API. This includes cross-site scripting in the meeting UI, malicious embeds, or compromised third-party content loaded into the renderer. The attacker calls the route with chosen source types and thumbnail dimensions, then exfiltrates the resulting image buffers over the network. User interaction is limited to being present in a meeting; no click on a share button is required.

javascript

// Security patch: screensharing/main.js
// Source: https://github.com/jitsi/jitsi-meet-electron-sdk/commit/144080fdddad2d11f7380475d4ac9bcf379cd035
            handler: this._onScreenSharingEvent
        });

-        // getSources may only be requested by this window's renderer.
+        // getSources may only be requested by this window's renderer, and only
+        // while a screen share the user actually started is in progress.
        addInvokeRoute(SCREEN_SHARE_GET_SOURCES, {
            owner: this._webContents,
-            handler: (_event, opts) => desktopCapturer.getSources(opts)
+            handler: (_event, opts) => this._getSources(opts)
        });

The patch gates getSources behind an active user-initiated share and, in screensharing/bridge.js, clamps thumbnail dimensions to a MAX_THUMBNAIL_DIMENSION of 320 pixels. See the Jitsi commit 144080f for the full diff.

Detection Methods for CVE-2026-92299

Indicators of Compromise

Renderer processes of Electron-based Jitsi clients issuing jitsi-screen-sharing-get-sources IPC calls outside an active screen-share workflow.
Outbound network traffic containing base64-encoded PNG or JPEG payloads originating from meeting client processes.
Installed @jitsi/electron-sdk package versions below 10.0.5 in application bundles or node_modules directories.

Detection Strategies

Inventory Electron applications and inspect bundled package.json and node_modules entries for vulnerable @jitsi/electron-sdk versions.
Monitor process telemetry for unexpected activation of screen capture APIs by meeting client processes when no share UI is visible.
Review renderer content-security-policy reports for third-party script loads inside Jitsi meeting windows.

Monitoring Recommendations

Alert on large image-shaped payloads egressing from Jitsi client processes to non-Jitsi domains.
Track version drift across desktop conferencing clients through endpoint software inventory reports.
Correlate meeting-client child process activity with operating system screen recording permission events.

How to Mitigate CVE-2026-92299

Immediate Actions Required

Upgrade @jitsi/electron-sdk to version 10.0.5 or later in all Electron applications that embed the SDK.
Rebuild and redistribute affected desktop clients to end users, then verify installed versions across managed endpoints.
Audit meeting pages for third-party script inclusions that could reach the exposed contextBridge API.

Patch Information

The fix is delivered in @jitsi/electron-sdk10.0.5 via commit 144080f. It restricts the SCREEN_SHARE_GET_SOURCES IPC handler to periods when a user-initiated share is active and clamps thumbnail dimensions to 320 pixels. See Pull Request #516 and the VulnCheck advisory for details.

Workarounds

Restrict meeting pages to first-party content and enforce a strict Content Security Policy that blocks untrusted scripts.
Disable or remove the screensharing module in custom Electron builds where screen sharing is not required.
Limit use of vulnerable clients to trusted meeting hosts until the patched SDK is deployed.

bash

# Upgrade the SDK in an affected Electron application
npm install @jitsi/electron-sdk@^10.0.5
npm ls @jitsi/electron-sdk