Description

A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the function syncInvoke of the component WebView JS Bridge. The manipulation leads to exposed dangerous routine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-12T15:17:07.620Z",
  "pubdate": "2026-10-12T15:17:07.620Z",
  "executiveSummary": "A critical security vulnerability has been identified in the SHAREit application, version 6.27.38_ww, specifically within the WebView JavaScript Bridge component.\nThe vulnerability involves the insecure implementation of the syncInvoke function, which facilitates an exposed dangerous routine, allowing for unauthorized execution of internal application functions.\nThe flaw enables remote attackers to exploit the bridge interface, potentially leading to arbitrary code execution or unauthorized access to sensitive application routines without requiring user authentication.\nGiven that the vulnerability has been publicly disclosed and the vendor has remained unresponsive, the risk of active exploitation is significant.\nThis vulnerability poses a substantial threat to user data privacy and system integrity, as the attack surface is exposed via the WebView bridge, allowing for remote exploitation vectors.",
  "technicalDetails": "The vulnerability resides in the WebView JS Bridge of the SHAREit Android application, version 6.27.38_ww. The root cause is an insecure implementation of the syncInvoke function, which acts as a bridge between the WebView (web content) and the underlying native Android application.\nThe syncInvoke function lacks proper validation or restriction mechanisms for the methods it exposes to the web context. This allows any content rendered within the WebView to invoke internal, privileged Java routines that should otherwise be protected from the JavaScript environment.\nIn a typical attack flow, an attacker leverages a malicious or compromised web page to target the application's WebView. By injecting JavaScript code into the page, the attacker calls the vulnerable syncInvoke function. Because the bridge does not sufficiently sanitize or whitelist the requested method names and parameters, the attacker can force the application to execute dangerous native routines.\nThe exploit does not require prior authentication or elevated system privileges on the device, as the WebView context provides the necessary execution environment. The attack is remotely exploitable if an attacker can lure a user to a malicious URL or intercept and modify HTTP traffic containing WebView content.\nPost-exploitation, an attacker can manipulate the application's internal state, access files, execute commands, or potentially exfiltrate sensitive data depending on the functionality provided by the reachable routines within the bridge. The lack of an access control list (ACL) or signature verification within the syncInvoke handler permits the execution of any routine accessible to the WebView bridge, significantly expanding the attack surface beyond the intended functionality.\nThis design flaw represents a failure in 'Secure Coding' practices regarding the bridging of high-privilege native code and low-privilege web content. The absence of a robust 'allowlist' for JavaScript-to-Native calls ensures that the underlying application's security posture is entirely dependent on the integrity of the remote web content rendered by the WebView."
}