OpenHuman is an open-source agent harness available as a desktop application and Rust library.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting the request, the shim falls through to native Chromium capture behavior, and the embedded CEF environment can auto-select the primary display because it lacks the normal desktop-media picker. If OpenHuman already has macOS Screen Recording permission and an attacker obtains JavaScript execution in an allowed embedded origin, the attacker can obtain a real desktop capture stream without a new user ges
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Tinyhumansai
- Product
- openhuman
- CVSS v3.1
- 6.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
- Fix
- available
- Weakness
- CWE-285, CWE-359
- Exposure class
- Collaboration, Browser, Operating system
- NVD status
- Received
Why it ranks 34 (Notable)
- CVSS v3.1 6.1 medium
- Product class: collaboration, browser
- Widely deployed vendor product (Tinyhumansai)
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-54144 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.