Remote Account Webview Vulnerability in OpenHuman on macOS

CVE-2026-54144

What is CVE-2026-54144?

The OpenHuman application, prior to version 0.56.0 on macOS, exhibits a critical vulnerability that allows unauthorized JavaScript code execution within a supported remote account webview. This flaw enables the runtime to enable the getDisplayMedia function without explicit user gestures, leading to potential exploitation. An attacker, with JavaScript execution capability in an authorized embedded origin, can gain direct access to a real-time desktop capture stream. This stream may unveil sensitive information, including but not limited to chats, documents, emails, credentials, and more. The vulnerability arises from a failure in origin validation during the screen sharing initiation process, which could lead to serious security compromises. Users are strongly urged to upgrade to version 0.56.0 or higher to mitigate this risk.

References