Element X Android Media Encryption Key Exposure Vulnerability via Well-Known File

A vulnerability in Element X Android has been identified, allowing the entity controlling the 'element.json' well-known file to access media encryption keys for Element Call calls. This issue affects Element X Android versions 0.4.16 through 25.03.3 and has been classified as high severity. The vulnerability arises under certain conditions where the well-known file is manipulated, potentially compromising the confidentiality of media communications.

Impact

Exploitation of this vulnerability allows unauthorized access to media encryption keys used in Element Call, which could lead to interception and decryption of private calls.

Remediation

Users can update to Element X Android version 25.03.4, where this vulnerability has been patched.