element-hq element-x-android up to 25.04.1 Hyperlink improper export of android application components

Summaryinfo

A vulnerability was found in element-hq element-x-android up to 25.04.1. It has been classified as critical. This affects an unknown part of the component Hyperlink Handler. The manipulation leads to improper export of android application components. This vulnerability is documented as CVE-2025-27599. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in element-hq element-x-android up to 25.04.1 and classified as critical. This issue affects an unknown code block of the component Hyperlink Handler. The manipulation with an unknown input leads to a improper export of android application components vulnerability. Using CWE to declare the problem leads to CWE-926. The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-27599 since 03/03/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

Upgrading to version 25.04.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch dc058544d7e693c04298191c1aadd5b39c9be52e is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• element-hq

Name

• element-x-android

Version

• 25.04.0
• 25.04.1

License

• open-source

Website

• Product: https://github.com/element-hq/element-x-android/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion