CVE-2024-26131

Element Android Intent Redirection

State: Published
Severity: 8.4 High
Published: Feb 20, 2024
Updated: Aug 1, 2024
Reserved: Feb 14, 2024

Description

Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
CWE-940 Improper Verification of Source of a Communication Channel

Affected Products

Product	Versions
element-androidelement-hq	>= 1.4.3, < 1.6.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.