OpenHuman embeds a Chromium‑based webview that allows page JavaScript to invoke getDisplayMedia. In versions prior to 0.56.0 on macOS the runtime incorrectly permits this call without the required user gesture, bypassing the normal desktop‑media picker and automatically selecting the primary display. Because OpenHuman already holds macOS Screen Recording permission and an attacker can execute JavaScript in an eligible embedded origin, the attacker obtains a continuous desktop capture stream revealing chats, documents, source code, credentials, and other sensitive visual data. This failure to enforce the user‑gesture requirement constitutes a CWE‑285 (Improper Authorization) and a CWE‑359 (Secret Material Exposure to Network) weakness, leading to unauthorized screen capture that compromises confidentiality.

Affected vendors and products: tinyhumansai’s OpenHuman application. Versions prior to 0.56.0 running on macOS are vulnerable. The issue is resolved in release 0.56.0, which enforces the required user‑gesture for getDisplayMedia calls. Any installation of older OpenHuman on macOS that retains screen‑recording permission is at risk.

The CVSS base score of 6.1 indicates a moderate severity, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the application already possess macOS Screen Recording permission and that an attacker achieves JavaScript execution in an allowed embedded origin. Once those conditions are met, the attacker can silently capture the entire desktop without any user interaction, making the exploit highly practical in environments where OpenHuman is used for remote collaboration. The failure to enforce user‑gesture and the lack of origin validation provide a CWE‑285 type mis‑authorization and a CWE‑359 sensitive data exposure risk. The primary defense remains the ability to prevent JavaScript execution in embedded origins and to restrict screen‑recording permissions.