A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. (CVE-2026-108897)

CVE-2026-108897 is a vulnerability in the SHAREit App 6.27.38_ww on Android, specifically in the syncInvoke function of the WebView JS Bridge component. This flaw allows remote attackers to manipulate the function to expose a dangerous routine. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor was contacted but did not respond, and no official fix or patch has been published. The exploit has been publicly disclosed but is not known to be exploited in the wild.

The vulnerability allows remote attackers to invoke a dangerous routine via the WebView JS Bridge's syncInvoke function, potentially leading to limited confidentiality impact (as indicated by CVSS: C:L, I:N, A:N). There is no indication of integrity or availability impact. The exposure of this routine could enable unauthorized access to sensitive information or functionality within the app.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should exercise caution when using the affected version. Consider limiting exposure or usage until an official fix is released.