CVE-2026-108897 in SHAREit App
Summary
by MITRE • 10/12/2026
A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The SHAREit application, developed by Smart Media4U Technology, represents a widely utilized file-sharing utility on the Android platform that facilitates rapid data transfer between devices over local networks or via internet relay. Version 6.27.38_ww contains a critical security flaw within its implementation of the WebView JavaScript Bridge mechanism. This component serves as an interface allowing web content rendered by the application to invoke native Java methods, thereby granting web-based scripts access to device functionalities that are typically restricted from untrusted code. The specific vulnerability resides in the syncInvoke function, which is designed to handle synchronous calls from JavaScript to the Android environment. Due to insufficient validation and sanitization of input parameters passed through this bridge, an attacker can manipulate these inputs to execute arbitrary native routines with elevated privileges within the application context.
This flaw constitutes a classic instance of insecure deserialization or improper restriction of remote functionality access, aligning closely with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-749 Exposed Dangerous Method in Android WebView JS Bridge. The technical root cause lies in the lack of rigorous filtering on method names and arguments before they are processed by the native layer. By crafting a malicious JavaScript payload, an adversary can bypass intended security boundaries to trigger sensitive operations such as reading private files, accessing contacts, or executing system commands. Because this vulnerability is located within the WebView component, it does not require physical access to the device nor does it necessitate complex social engineering beyond convincing a user to visit a crafted web page while the SHAREit app is active in the background or foreground.
The operational impact of this vulnerability is severe due to its remote exploitability and public disclosure status. Attackers can host malicious websites that automatically trigger the exploitation sequence when accessed by users running the affected version of SHAREit on Android devices. The successful exploitation allows for unauthorized data exfiltration, potentially compromising user privacy by exposing personal photos, documents, and contact lists stored locally or synced through the application. Furthermore, since the vendor has not responded to early notifications regarding this disclosure, there is a significant window of exposure where users remain vulnerable without official patches or mitigations provided by Smart Media4U Technology. The public availability of exploit code increases the likelihood of automated attacks targeting unpatched installations across large user bases.
To mitigate these risks in the absence of an immediate vendor patch, administrators and security teams should enforce strict application control policies that restrict the execution of SHAREit on high-security devices or limit its network permissions to prevent it from loading external web content unnecessarily. Users are advised to disable JavaScript execution within any embedded browsers if possible, although this is often not configurable by end-users in standard app implementations. The most effective long-term mitigation involves upgrading to a patched version once the vendor releases one, but given their lack of response, users should consider uninstalling the application and switching to alternative file-sharing tools that adhere to secure coding practices for WebView JS Bridge interactions. Security monitoring solutions can also be configured to detect anomalous behavior patterns associated with JavaScript-to-native method invocations originating from known vulnerable applications.