Element X Android Webpage Loading Vulnerability Granting Access to Microphone and Camera

A vulnerability in Element X Android, prior to version 25.04.2, allows a crafted hyperlink or a maliciously designed local app to force Element X to load a webpage. This webpage can gain temporary access to the device's microphone and camera, similar to permissions granted to Element Call.

Impact

Exploitation of this vulnerability could lead to unauthorized access to the device's microphone and camera.

Reproduction

The vulnerability can be reproduced by sending a crafted hyperlink to a device with Element X Android version 25.04.1 or earlier. Alternatively, a locally installed malicious app can be used to trigger the vulnerability by sending an intent that includes a URL pointing to a webpage that will request access to the microphone and camera.

Remediation

Users can update to Element X Android version 25.04.2 or later to address this vulnerability.