CVE-2025-27599: Element X Android vulnerable to loading malicious web pages via received intent
Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27599?
CVE-2025-27599 is rated as moderate severity due to its potential exploitation through malicious web content.
How do I fix CVE-2025-27599?
To resolve CVE-2025-27599, upgrade Element X Android to version 25.04.2 or later.
What versions of Element X Android are affected by CVE-2025-27599?
Element X Android versions prior to 25.04.2 are affected by CVE-2025-27599.
What types of attacks can CVE-2025-27599 facilitate?
CVE-2025-27599 can facilitate attacks by loading malicious web pages with similar permissions to Element Call.
Who is at risk from CVE-2025-27599?
Users of Element X Android versions before 25.04.2 are at risk from CVE-2025-27599.