{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "0.56.0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StringRangeExpression"
              },
              {
                "range": [
                  {
                    "fixed": "60050aa09a870f53ed7e4cd40ed41fd2860329e7"
                  }
                ],
                "source": "REFERENCES_COMMIT"
              },
              {
                "original_tag": "v0.56.0",
                "range": [
                  {
                    "fixed": "e8968077aeb5c6a687d52f3f58474363c2f3f7ed"
                  }
                ],
                "source": "REFERENCES_TAG"
              }
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "e8968077aeb5c6a687d52f3f58474363c2f3f7ed"
            },
            {
              "fixed": "60050aa09a870f53ed7e4cd40ed41fd2860329e7"
            }
          ],
          "repo": "https://github.com/tinyhumansai/openhuman",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-936r-hw6f-jjf2"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-285",
      "CWE-359"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54144.json"
  },
  "details": "OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting the request, the shim falls through to native Chromium capture behavior, and the embedded CEF environment can auto-select the primary display because it lacks the normal desktop-media picker. If OpenHuman already has macOS Screen Recording permission and an attacker obtains JavaScript execution in an allowed embedded origin, the attacker can obtain a real desktop capture stream without a new user gesture. The stream can expose chats, documents, source code, email, meeting content, credentials, one-time codes, and other visible desktop information. The separate direct screen_share_begin_session IPC path failing origin validation does not prevent exploitation through getDisplayMedia. This issue is fixed in version 0.56.0.",
  "id": "CVE-2026-54144",
  "modified": "2026-11-05T21:16:07.805879285Z",
  "published": "2026-11-05T16:14:46.830Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54144.json"
    },
    {
      "type": "FIX",
      "url": "https://github.com/tinyhumansai/openhuman/commit/60050aa09a870f53ed7e4cd40ed41fd2860329e7"
    },
    {
      "type": "FIX",
      "url": "https://github.com/tinyhumansai/openhuman/pull/2636"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tinyhumansai/openhuman/releases/tag/v0.56.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-936r-hw6f-jjf2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54144"
    }
  ],
  "schema_version": "1.9.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture"
}