Exposed dangerous routine in Smart Media4U SHAREit App JS Bridge
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Smart Media4U Technology SHAREit App 6.27.38_ww on Android contains CWE-749, an exposed dangerous method. Manipulating the syncInvoke function of the WebView JS Bridge leads to an exposed dangerous routine. A remote attacker needs no privileges or user interaction. A public exploit has been disclosed and is linked in the references, and the vendor did not respond to early contact about the disclosure.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Smart Media4U Technology | SHAREit App | 6.27.38_ww | — | No fix listed | CNA |
- SHAREit App VendorSmart Media4U Technology Affected 6.27.38_ww Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:smart_media4u_technology:shareit_app:*:*:*:*:*:*:*:* | — | — | Smart Media4U Technology |
- cpe:2.3:a:smart_media4u_technology:shareit_app:*:*:*:*:*:*:*:* Versions — — ·Smart Media4U Technology
Remediation
The sources list no fixed version for SHAREit App.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-12 Threatist record created from CVE-2026-108897
- 2026-10-12 Alias added: GHSA-vf4g-f748-gv9p
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: LOW → HIGH
References
Sources
- CVE-2026-108897 · CVE Program
- CVE-2026-108897 · NVD
- FIRST EPSS
- GHSA-vf4g-f748-gv9p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences