The vulnerability allows any script running in a Jitsi meeting page to invoke the getDesktopSources() API through the contextBridge without the need for an active getDisplayMedia() permission request. This API returns a list of available screens and windows, and when routed via the jitsi-screen-sharing-get-sources IPC channel, it can deliver desktop thumbnails at arbitrary resolution. The behavior is implemented in Electron.js as a privileged API exposed to the renderer process, and because no user consent or operating‑system permission is requested, an attacker from a malicious script can enumerate screens and retrieve thumbnails. The flaw results directly from an authorization weakness (CWE‑862) that allows privileged operations to be performed by untrusted code.

Affected systems include the Jitsi/electron-sdk, specifically any installation before version 10.0.5. The vulnerability is present in builds of the open‑source Jitsi Meet Electron application derived from the affected code base.

The CVSS score of 7.1 rates this vulnerability as high severity, indicating a substantial impact on information confidentiality if exploited. The EPSS score is reported as less than 1%, reflecting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that a malicious or compromised script runs within the meeting page context; the attacker can then retrieve screen information without OS permission prompts. The lack of a user‑initiated screen normally provide, making the attack feasible from within the host application itself or from a malicious participant’s embedded code.