Threats tagged 'ghsa-q3gq-fmhq-w6pr'

A missing authorization vulnerability in @jitsi/electron-sdk versions before 10.0.5 allows any script in the meeting page to enumerate screens and windows without user consent. This occurs because the getDesktopSources() function is exposed via contextBridge without requiring an active getDisplayMedia() picker. Attackers can retrieve desktop thumbnails at arbitrary resolution by calling the jitsi-screen-sharing-get-sources IPC route without operating system permission prompts.