@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.

CVE-2026-92299 affects @jitsi/electron-sdk versions before 10.0.5, where the getDesktopSources() API is exposed via Electron's contextBridge without requiring an active getDisplayMedia() picker. This allows any script running in the meeting page to enumerate screens and windows without user consent. Attackers can invoke the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution, bypassing operating system permission prompts entirely. The vulnerability poses a significant privacy risk as it enables silent screen capture of a victim's desktop during a Jitsi meeting session. The fix was introduced in version 10.0.5, which adds proper gating logic to restrict access to screen sources. Proof-of-concept references and patch details are available via the official GitHub repository and commit history. The issue was also documented by VulnCheck in their advisory database.