CVE-2025-27599 - CVE House

Back to Database

Status published Medium CVE-2025-27599

Element X Android vulnerable to loading malicious web pages via received intent

6.5 CVSS

Vulnerability Description

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-27599

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from element-hq

View All →

Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password

Synapse: Invalid device keys degrade federation functionality

In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left

Element Web could load a malicious instance of Element Call leaking media encryption keys

Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

Affected Vendor

element-hq

View all reports →

Affected Software

element-x-android

Vulnerable Versions:

< 25.04.2

Timeline

Official Publish: April 18th, 2025

Last Modified: April 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation