A serious vulnerability in the Jitsi Electron SDK allows malicious video conferencing content to request images from available screens without the user's normal selection. The issue is documented as CVE-2026-92299 and affects applications that integrate the SDK.
The vulnerability isn't just about displaying an incorrect preview. CVE-2026-92299 can reveal desktop and window thumbnails even when the user hasn't confirmed sharing. The issue becomes particularly sensitive in meetings where documents, notifications, or client data are displayed.
See also: Car data: Your car is spying on you
What CVE-2026-92299 reveals
According to the CVE-2026-92299, versions of the @jitsi/electron-sdk package prior to 10.0.5. The vulnerability lies in the Electron communication bridge and the way the application exposes the getDesktopSources() to the meeting page.
Normally, screen sharing should start after the user activates the relevant process and selects what to share. In the vulnerable implementation, a script inside the page could call the jitsi-screen-sharing-get-sources without an active getDisplayMedia(). This would allow it to enumerate screens and windows and request their thumbnails.
CVE-2026-92299 has a score of 7.4 and is classified as high. The assessment vector includes unprivileged remote access, but also requires interaction because the victim must use an affected application. The impact is primarily privacy-related, as the screen image may contain elements that were not intended for the meeting.
The fix in the Jitsi Electron SDK
The fix was implemented in the Jitsi Electron SDK with changes to the screen sharing files. As described in pull request 516, the app now checks if there is a sharing request in progress before allowing resources to be retrieved from Electron.
The new flow rejects the call when there is no pending request and returns the error No screen sharing request in progress. At the same time, the dimensions of the thumbnails are converted to integers and limited to a maximum of 320 pixels. This approach reduces both uncontrolled access and abuse of the preview function.
CVE -2026-92299 is fixed by upgrading to version 10.0.5 or later. The Jitsi team also states that version 10 enables context isolation, so that the page's code has less access to Electron features. Developers should check not only the direct package, but also the applications that embed it.
See also: Microsoft Recall: Vulnerability exposes decrypted user data
What administrators should check
The first step is to inventory the video conferencing applications that use @jitsi/electron-sdk. CVE-2026-92299 can remain active in an old package even when the core Jitsi service is functioning normally. Development teams should check lock files, application dependencies, and how meeting content is loaded.
Until the update is complete, the SecNews technical team recommends limiting the use of untrusted links within meetings and avoiding displaying sensitive documents on a shared desktop. Administrators can also monitor for unusual calls to the sharing mechanism and review application logs.
Particular care is needed on corporate computers, where the desktop often includes messages, dashboards or files not related to the video conference. Their potential exposure can create investigative and reporting obligations, even if a permanent copy was not saved.
Security managers should inform users that the sharing option should be clearly displayed and require active action. At the same time, development teams should reconsider the communication bridges between web content and native operating system functions.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The update should be tested in a controlled environment because version 10 includes changes that may require adjustments to how the SDK is imported and how Electron is configured. CVE-2026-92299 is not addressed by simply changing permissions on the user account, as the problematic call is executed within the application flow.
See also: CVE-2026-15899: Critical UAF in Chrome's CameraCapture
CVE -2026-92299 is a reminder that video conferencing applications should not be considered secure just because they use an encrypted connection. The bridges between the page, Electron, and the operating system require separate checks. Upgrading the Jitsi Electron SDK to version 10.0.5 or later is the key mitigation.
