CVE-2026-54144

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting the request, the shim falls through to native Chromium capture behavior, and the embedded CEF environment can auto-select the primary display because it lacks the normal desktop-media picker. If OpenHuman already has macOS Screen Recording permission and an attacker obtains JavaScript execution in an allowed embedded origin, the attacker can obtain a real desktop capture stream without a new user gesture. The stream can expose chats, documents, source code, email, meeting content, credentials, one-time codes, and other visible desktop information. The separate direct screen_share_begin_session IPC path failing origin validation does not prevent exploitation through getDisplayMedia. This issue is fixed in version 0.56.0.

• CWE-285
• CWE-359

• https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7
• https://github.com/tinyhumansai/openhuman/pull/2636
• https://github.com/tinyhumansai/openhuman/releases/tag/v0.56.0
• https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-936r-hw6f-jjf2

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54136Windmill is an open-source developer platform for internal c…5.1
• CVE-2026-5414A security flaw has been discovered in Newgen OmniDocs up to…5.5
• CVE-2026-54140OpenHuman is an open-source agent harness available as a des…8.3
• CVE-2026-54141OpenHuman is an open-source agent harness available as a des…9
• CVE-2026-54142OpenHuman is an open-source agent harness available as a des…8.7
• CVE-2026-54143OpenHuman is an open-source agent harness available as a des…9.8
• CVE-2026-54145OpenHuman is an open-source agent harness available as a des…8.8
• CVE-2026-54146OpenHuman is an open-source agent harness available as a des…8.8
• CVE-2026-54147http4k is a functional toolkit for Kotlin HTTP applications.…6.5
• CVE-2026-54148http4k is a functional toolkit for Kotlin HTTP applications.…8.1
• CVE-2026-54149MaxKB is an open-source AI assistant for enterprise. Prior t…8.8
• CVE-2026-5415The WP Captcha PRO (the premium version of the Advanced Goog…8.8