{"id":"CVE-2026-55644","kind":"vulnerability","aliases":["CVE-2026-55644"],"related":[],"title":"Element X iOS: crafted call URL loads attacker page with camera and microphone","description":"Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an attacker-controlled origin inside the call screen's WKWebView which will be granted device microphone and camera permissions (provided the user has previously granted these permissions to Element X iOS). This issue has been patched in version 26.05.0.","summary":"Element X iOS before 26.05.0 does not check the URL allowlist when it parses io.element.call:// links. A user who opens a crafted link can have an attacker-controlled page loaded in the call screen, which inherits the microphone and camera permissions already granted to the app.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios","matrix","mobile","package"],"not_affected_if":["no-camera-or-mic-permission","patched-version"],"how_to_check":"- Check the installed Element X iOS version in the app's About screen or App Store listing; versions before `26.05.0` are exposed.\n- Confirm whether microphone or camera permission has been granted to Element X in iOS Settings.","fix":"- Update Element X iOS to `26.05.0` or later.\n- Revoke camera and microphone permission for Element X in iOS Settings until the update is installed, if the team cannot update right away.","status":"open","published_at":"2026-10-19T18:17:08+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:29:07+00:00","updated_at":"2026-10-25T04:29:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:29:07Z","model":"claude-haiku-5-5","output":{"fix":"- Update Element X iOS to `26.05.0` or later.\n- Revoke camera and microphone permission for Element X in iOS Settings until the update is installed, if the team cannot update right away.","reach":"internet","title":"Element X iOS: crafted call URL loads attacker page with camera and microphone","impact":"medium","summary":"Element X iOS before 26.05.0 does not check the URL allowlist when it parses io.element.call:// links. A user who opens a crafted link can have an attacker-controlled page loaded in the call screen, which inherits the microphone and camera permissions already granted to the app.","category":"package","nicknames":[],"who_cares":["ios","matrix","mobile"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker page runs with the app's microphone and camera access","analyst_note":"","how_to_check":"- Check the installed Element X iOS version in the app's About screen or App Store listing; versions before `26.05.0` are exposed.\n- Confirm whether microphone or camera permission has been granted to Element X in iOS Settings.","needs_analyst":false,"not_affected_if":["patched-version","no-camera-or-mic-permission"],"who_is_affected":"Users of Element X iOS, the Matrix client from Element, on versions before 26.05.0 who have granted microphone or camera access to the app. Exposure requires a user to open a crafted io.element.call:// link. Devices running a patched version, or users who have never granted those permissions, are not at the same risk.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3375,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-55644':16A,19A '26.05.0':28B,87C,157C 'abl':101C,115C 'allowlist':34B,93C 'alreadi':66B 'app':70B 'attack':8A,51B,99C,120C 'attacker-control':50B,119C 'call':5A,57B,125C 'camera':11A,64B,136C 'check':31B,90C 'client':78C 'control':52B,121C 'craft':4A,45B,110C 'cve':14A,17A 'devic':133C 'element':1A,24B,71C,81C,82C,147C 'fail':88C 'grant':67B,132C,143C 'inherit':60B 'insid':123C 'io':3A,20B,26B,73C,77C,84C,149C 'io.element.call':38B,96C,111C 'issu':151C 'link':39B,46B 'load':7A,54B,117C 'malici':109C 'matrix':21B,76C 'microphon':13A,62B,134C 'mobil':22B 'open':43B,107C 'origin':122C 'packag':23B 'page':9A,53B 'pars':37B,95C 'patch':154C 'permiss':65B,137C,145C 'previous':142C 'provid':79C,138C 'screen':58B,126C 'trick':103C 'url':6A,33B,92C,112C 'user':41B,105C,140C 'version':86C,156C 'wkwebview':128C 'x':2A,25B,72C,83C,148C","nicknames":[],"mitigations":[],"who_affected":"Users of Element X iOS, the Matrix client from Element, on versions before 26.05.0 who have granted microphone or camera access to the app. Exposure requires a user to open a crafted io.element.call:// link. Devices running a patched version, or users who have never granted those permissions, are not at the same risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T18:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55644","severity":null,"published_at":"2026-10-19T18:17:08+00:00","modified_at":"2026-10-22T21:17:19+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}