CVE-2026-92704 in SharpEmu
Summary
by MITRE • 11/04/2026
SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its do_POST handler in tools/SharpEmu.DebuggerFrontend/debugger_frontend.py does not validate the Origin, Referer, Sec-Fetch-Site, or Host headers. The _read_json_body() function also accepts JSON sent with browser-simple content types instead of requiring application/json . A malicious page that can reach the loopback listener can send cross-origin requests to /api/launch , /api/command , and /api/connect . Chromium may require Local Network Access permission for pages served from public origins. Local-origin pages and other delivery paths are not consistently subject to this restriction. The /api/launch endpoint accepts an attacker-selected emulatorPath if it points to an existing file on the victim’s host. On POSIX systems, that file must also be executable. The endpoint additionally requires an existing ebootPath . The /api/command endpoint exposes debugger operations, including write-memory , set-register , and continue . The /api/connect endpoint can initiate outbound TCP connections. These operations can let an attacker execute an existing binary with the victim’s privileges, control the attached emulated process, or reach network services accessible from the host. DNS rebinding can additionally let the attacker read API responses interactively. This issue is fixed in version 0.0.3-release.3-patch.1
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
SharpEmu represents an experimental PlayStation 5 emulator designed for Windows and Linux environments, presenting a unique attack surface due to its integration of debugging tooling within the application architecture. In versions prior to 0.0.3-release.3-patch.1, specifically affecting version 0.0.3-release.3 and earlier releases that include repository-provided debugger frontend components not present in standard release archives, a critical security flaw exists within the HTTP API exposed by the debugger frontend tooling. This vulnerability stems from insufficient access controls and input validation mechanisms embedded in the backend logic of tools/SharpEmu.DebuggerFrontend/debugger_frontend.py. The service binds to the loopback interface on port 8765 without implementing any form of authentication or Cross-Site Request Forgery (CSRF) protection tokens, creating a scenario where local network access can be leveraged for malicious purposes despite the non-public binding address.
The core technical flaw lies in the do_POST handler and associated parsing functions which fail to validate critical HTTP headers such as Origin, Referer, Sec-Fetch-Site, or Host. This omission allows cross-origin requests from any web page that can reach the loopback listener, effectively bypassing standard browser-based origin checks. Furthermore, the _read_json_body() function exhibits lax content type validation by accepting JSON payloads sent with generic browser-simple content types rather than strictly requiring application/json. This permissiveness facilitates easier exploitation via standard HTML forms or JavaScript fetch requests from malicious web pages that do not need to set specific headers to trigger the vulnerability logic.
The operational impact of this vulnerability is severe, as it grants an attacker who can deliver a crafted webpage to the victim's browser significant control over the emulator and potentially the host system. The /api/launch endpoint allows an attacker to specify an arbitrary emulatorPath if that path points to an existing file on the victim’s local filesystem. On POSIX systems, this requires the file to be executable, but on Windows, it may allow execution of various binary formats depending on how the underlying process is spawned. This effectively enables Remote Code Execution (RCE) by allowing a malicious page to launch arbitrary binaries with the privileges of the user running SharpEmu. Additionally, the /api/command endpoint exposes sensitive debugger operations including write-memory, set-register, and continue commands. These capabilities allow an attacker to manipulate the state of the emulated process directly, potentially leading to further exploitation within the emulator environment or extraction of sensitive data stored in memory.
Beyond local execution, the vulnerability extends into network interaction through the /api/connect endpoint which can initiate outbound TCP connections from the host machine. This functionality transforms the browser-based attack vector into a potential proxy for reaching internal network services that are accessible from the victim's host but not directly exposed to the internet. Attackers can leverage DNS rebinding techniques to bypass same-origin policies and interactively read API responses, effectively turning the local emulator instance into an open relay or pivot point for lateral movement within a trusted network segment. While Chromium-based browsers may require explicit Local Network Access permissions for pages served from public origins, this restriction is not consistently applied across all delivery paths or browser configurations, leaving many users vulnerable to these attacks through locally hosted malicious sites or other bypass techniques.
This issue aligns with CWE-352 Cross-Site Request Forgery and CWE-94 Improper Control of Generation of Code due to insufficient validation, as well as ATT&CK technique T1059 Command and Scripting Interpreter for the execution aspect and T1071 Application Layer Protocol for the network communication abuse. The vulnerability is resolved in version 0.0.3-release.3-patch.1 which implements proper header validation, enforces strict content type checking, and likely introduces authentication or CSRF token requirements to mitigate these risks. Users of SharpEmu should immediately upgrade to the patched version and avoid running untrusted web pages while the emulator is active with debugger tooling enabled.