SHAREit EUVD-2026-97473

Requires the SHAREit Android app (version 6.27.38_ww) to render attacker-controlled web content in its WebView, where the JavaScript bridge exposes the dangerous syncInvoke routine (CWE-749, exposed dangerous method). The practical limiting factor is that the victim must be induced to open or load the malicious page inside the app - the PoC is titled '1-click.html,' indicating user interaction is needed despite the input vector's UI:N. Impact is confined to confidentiality (information disclosure, VC:L); there is no integrity or availability impact, and no authentication is required once the malicious content is loaded.

This is a moderate, lower-priority issue rather than an urgent one. The input CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) scores only 5.5 with a single Low confidentiality impact (VC:L) and no integrity or availability impact (VI:N/VA:N), reflecting a limited information-disclosure flaw in SHAREit's WebView JavaScript bridge rather than code execution. Exploitation maturity is Proof-of-Concept only (E:P in the vector), consistent with the 'publicly available exploit' signal; there is NO CISA KEV listing and NO EPSS value supplied, so active, widespread exploitation is not evidenced - status is best read as 'publicly available exploit code exists,' not active exploitation. A notable conflict: the official vector sets UI:N (no user interaction), yet the designated exploit reference is named '1-click.html,' and WebView JS-bridge abuse of this type typically requires the victim to open attacker-controlled web content inside the app - this strongly implies user interaction (UI:R) is actually needed, which would lower real-world risk below the stated 5.5. The vulnerability was reported by VulDB (a third-party disclosure aggregator), and the vendor was contacted but did not respond, so there is no vendor-confirmed patch. Overall: a real but low-to-moderate, interaction-dependent confidentiality bug on a widely-installed consumer app, not a critical remote-exploitation emergency.

An attacker crafts a malicious web page that abuses the exposed syncInvoke method of SHAREit's WebView JavaScript bridge and lures a SHAREit user into loading it inside the app's in-app browser/WebView. When the page's JavaScript calls the exposed dangerous routine, it reaches privileged app functionality and discloses sensitive information to the attacker. A public proof-of-concept exploit ('1-click.html') exists, but no active exploitation has been confirmed.