Element Web Media Encryption Key Exposure Vulnerability in Element Call Integration

A vulnerability in Element Web versions 1.11.16 prior to 1.11.96 allows external pages to access media encryption keys used in Element Call. This issue arises when Element Web is configured to load Element Call from an external URL.

Impact

Exploitation of this vulnerability could lead to unauthorized access to media encryption keys, potentially allowing interception or manipulation of encrypted media in Element Call.

Remediation

Users can update to Element Web version 1.11.97 or later to address this vulnerability. Alternatively, Element Web can be configured to load a trusted instance of Element Call.