CVE-2026-108897
Received Received - Intake

Remote Code Execution in SHAREit Android App

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108897
EUVD
EUVD-2026-97473

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Smart Media4U Technology SHAREit App 6.27.38_ww

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-749 The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in SHAREit App 6.27.38_ww for Android due to a flaw in the WebView JS Bridge component's syncInvoke function. It allows remote attackers to execute dangerous routines by manipulating the bridge, potentially accessing sensitive data or performing unauthorized actions.

Detection Guidance

Detecting this vulnerability requires checking for exposed WebView JS Bridge functionality in the SHAREit app. Monitor network traffic for suspicious deep links or JS bridge interactions. Use Android debugging tools like adb to inspect app behavior and look for unintended intent executions or token theft attempts.

Impact Analysis

An attacker could exploit this to steal sensitive tokens, execute arbitrary intents like opening apps, or access device information without user interaction. This could lead to data theft, unauthorized actions, or further compromise of the device.

Compliance Impact

This vulnerability may violate GDPR due to unauthorized data access and HIPAA if sensitive health data is exposed. It undermines data protection requirements for confidentiality and integrity, potentially leading to compliance breaches and legal consequences.

Mitigation Strategies

Immediately uninstall or disable the SHAREit app until a patch is released. Block suspicious network traffic related to the app's WebView JS Bridge. Monitor for unusual activity like unauthorized intent executions or token access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108897. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart