What’s Vulnerable › Vulnerabilities

CVE-2025-27599: Element X Android vulnerable to loading malicious web pages via received intent

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-18 · updated 2026-06-17
• Weakness: CWE-20

Description

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.

Affected products

• element-hq element-x-android: before 25.04.2

References

• https://github.com/element-hq/element-x-android/commit/dc058544d7e693c04298191c1aadd5b39c9be52e
• https://github.com/element-hq/element-x-android/releases/tag/v25.04.2
• https://github.com/element-hq/element-x-android/security/advisories/GHSA-m5px-pwq3-4p5m

Get alerted when CVE-2025-27599 or the next vulnerability affects your stack