Shareit App
Monthly
SHAREit for Android 6.27.38_ww exposes a dangerous JavaScript bridge routine (syncInvoke) that allows attacker-controlled web content rendered inside the app's WebView to invoke privileged native functionality, resulting in limited information disclosure. Exploitation is unauthenticated but requires the victim to open or load a malicious page within the app, as demonstrated by the publicly available '1-click.html' proof-of-concept; no confirmed active exploitation (CISA KEV) is reported. Given the low confidentiality-only impact and the user-interaction prerequisite, this is a moderate, lower-priority issue.
SHAREit for Android 6.27.38_ww exposes a dangerous JavaScript bridge routine (syncInvoke) that allows attacker-controlled web content rendered inside the app's WebView to invoke privileged native functionality, resulting in limited information disclosure. Exploitation is unauthenticated but requires the victim to open or load a malicious page within the app, as demonstrated by the publicly available '1-click.html' proof-of-concept; no confirmed active exploitation (CISA KEV) is reported. Given the low confidentiality-only impact and the user-interaction prerequisite, this is a moderate, lower-priority issue.