Live › vulnerability › CVE-2026-55644
Go to dashboardElement X iOS before 26.05.0 does not check the URL allowlist when it parses io.element.call:// links. A user who opens a crafted link can have an attacker-controlled page loaded in the call screen, which inherits the microphone and camera permissions already granted to the app.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Users of Element X iOS, the Matrix client from Element, on versions before 26.05.0 who have granted microphone or camera access to the app. Exposure requires a user to open a crafted io.element.call:// link. Devices running a patched version, or users who have never granted those permissions, are not at the same risk.
No product ranges from the sources yet.
26.05.0 are exposed.26.05.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an attacker-controlled origin inside the call screen's WKWebView which will be granted device microphone and camera permissions (provided the user has previously granted these permissions to Element X iOS). This issue has been patched in version 26.05.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-55644")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.