CVE-2025-27599

Element X Android vulnerable to loading malicious web pages via received intent

State: Published
Severity: 6.5 Medium
Published: Apr 18, 2025
Updated: Apr 18, 2025
Reserved: Mar 3, 2025

Description

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-926 Improper Export of Android Application Components
CWE-20 Improper Input Validation

Affected Products

Product	Versions
element-x-androidelement-hq	< 25.04.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.