element-hq element-x-android vulnerabilities

Latest element-hq element-x-android CVEs

Newest publication first

1. CVE-2025-27599 Element X Android vulnerable to loading malicious web pages via received intent

   Published 2025-04-18

   Medium·CVSS 6.5 EPSS 0.38%

   Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automati...

2. CVE-2025-31127 Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

   Published 2025-04-03

   Medium·CVSS 5.3 EPSS 0.20%

   Element X Android is a Matrix Android Client provided by element.io. In Element X Android versions between 0.4.16 and 25.03.3, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Eleme...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.