CVE-2024-26131: element-hq element-android

Vulnerability summary

CVE-2024-26131 is a high (CVSS 8.4) vulnerability in element-hq element-android. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.6% of scored vulnerabilities.

Timeline

1. 20-02-2024
   PublishedVulnerability first disclosed.
2. 01-08-2024
   Last modifiedVulnerability information updated.

Description

Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

• CWE-923Improper Restriction of Communication Channel to Intended EndpointsThe product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
• CWE-940Improper Verification of Source of a Communication ChannelThe product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.