CVE-2026-54144

OpenHuman’s embedded meeting page can capture the macOS desktop

Tiny Humans · OpenHuman macOS desktop capture

First documented disclosure · Review checkpoint

Summary

An embedded Google Meet page can capture the desktop without a fresh user gesture.

Severity and exploitation evidence

Medium · 6.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The native desktop bridge granted capture capability to content inside a remote meeting webview.

Conditions required

The victim must use the affected macOS webview and the application must have the operating-system permission needed for screen capture.

Potential impact

Remote page content can capture desktop material without a new user gesture.

Affected versions and configurations

Before 0.56.0 on macOS.

Fix and mitigation status

0.56.0.

Practical next steps

Upgrade to 0.56.0 and review the app’s macOS screen-recording permission.

Operating lesson

Bind sensitive native capabilities to a trusted origin and an explicit user gesture.

Evidence and limits

The dated public project record and the later CVE describe the same affected component. The fixed version is identified by the project or assigning authority.

Sources