CVE-2026-54144 OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting...

CVE-2026-54144

The OpenHuman desktop application and Rust library are vulnerable on macOS versions prior to 0.56.0 . The issue resides in the runtime injected into supported remote account webviews (e.g., Google Meet), where a shim fails to reject getDisplayMedia calls made without a live user gesture. Conseque...