CVE-2026-108897: Exposed Dangerous Routine in Smart Media4U Technology SHAREit App

CVE-2026-108897 is a security vulnerability in the SHAREit App version 6.27.38_ww for Android, specifically in the syncInvoke function of the WebView JS Bridge component. This vulnerability exposes a dangerous routine that can be triggered remotely without requiring user interaction or privileges. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The vendor was notified but has not issued any response or patch. Public disclosure of the exploit exists, but no active exploitation has been confirmed.

An attacker can remotely invoke a dangerous routine through the vulnerable syncInvoke function in the WebView JS Bridge, potentially leading to unauthorized actions within the app context. The vulnerability does not require user interaction or privileges, increasing the risk of remote exploitation. However, no known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should exercise caution when using version 6.27.38_ww of the SHAREit App and consider avoiding its use until an official patch or mitigation is released.