Description
@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jitsi | @jitsi/electron-sdk | < 10.0.5 | 10.0.5 |
References
- Pull Request #516 patch issue-tracking
- Patch Commit patch
- Ungated SCREEN_SHARE_GET_SOURCES invoke route technical-description
- Gated _getSources() in 10.0.5 technical-description
- https://github.com/jitsi/jitsi-meet-electron-sdk product
- VulnCheck Advisory: @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture third-party-advisory