Read the docs
TI-2026-76542 Aliases CVE-2026-55644

Element X iOS deeplink grants mic and camera to attacker origin

Priority LOW 23CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Element X iOS before 26.05.0 fails to check the URL allowlist when parsing io.element.call:// deeplinks. This is improper input validation (CWE-20). If a user is tricked into opening a crafted io.element.call:// URL, an attacker-controlled origin loads in the call screen's WKWebView and receives the microphone and camera permissions the user previously granted to Element X iOS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an attacker-controlled origin inside the call screen's WKWebView which will be granted device microphone and camera permissions (provided the user has previously granted these permissions to Element X iOS). This issue has been patched in version 26.05.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Fix Fixed element-x-ios (element-hq): 26.05.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
element-hqelement-x-iosbefore 26.05.026.05.0Patch availableCNA
  • element-x-ios Vendorelement-hq Affected before 26.05.0 Fixed in 26.05.0 Patch available CNA

Remediation

Update Element X iOS to version 26.05.0, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA element-x-ios (element-hq) Fixed in 26.05.0

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-55644
  2. 2026-10-23 CISA SSVC decision points changed

References

Other 4

  • TI-2024-35327 Synapse allows a a malformed invite to break the invitee's `/sync` CVSS 4.0HIGH 8.7
  • TI-2024-36056 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVSS 4.0HIGH 8.2
  • TI-2024-35318 Synapse allows unsupported content types to lead to memory exhaustion CVSS 4.0HIGH 8.2
  • TI-2022-07650 Remote program execution with user interaction CVSS 3.1HIGH 8.8
  • TI-2026-19372 ESS Community Helm Chart has a weak server key generation method CVSS 4.0CRITICAL 9.2
  • TI-2024-24814 Synapse denial of service through media disk space consumption CVSS 3.1HIGH 7.5
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences