CVE-2025-27599CWE-20CWE-926

Element X Android vulnerable to loading malicious web pages via received intent

Medium · published April 18, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
29.4
In the wild
Unconfirmed
What it is

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00367 · 29.4th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-926 · Improper Export of Android Application Components
Published
2025-04-18T15:49Z
EPSS history
Timeline
  • 18 APR 15:49Z
    Element X Android vulnerable to loading malicious web pages via received intent
    cvelistv5