Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-27599

Element X Android vulnerable to loading malicious web pages via received intent

Description

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

element-hq element-x-android

  • < 25.04.2affected

References