Skip to content

Element X Android vulnerable to loading malicious web pages via received intent

High
davidegirardi published GHSA-m5px-pwq3-4p5m Apr 17, 2025

Package

No package listed

Affected versions

<= 25.04.1

Patched versions

25.04.2

Description

Impact

A crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera.

Even if the CVSS score is 5.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) we consider this issue as a High severity.

Patches

Fixed in version 25.04.2

For more information

If you have any questions or comments about this advisory, please email us at security at element.io.

Severity

High

CVE ID

CVE-2025-27599

Weaknesses

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Learn more on MITRE.

Improper Export of Android Application Components

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains. Learn more on MITRE.