Vulnerability · Published Feb 20, 2024 · Assigned by GitHub_M

CVE-2024-26131Element Android Intent Redirection

High 8.4

In plain English

A high-severity security flaw in element-android from element-hq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)0.5%top 58.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

Affected products (as reported)

Vendor	Product	Versions
element-hq	element-android	>= 1.4.3, < 1.6.12

Weakness: CWE-923, CWE-940 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vm x_refsource_CONFIRM
https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9 x_refsource_MISC
https://element.io/blog/security-release-element-android-1-6-12 x_refsource_MISC
https://support.google.com/faqs/answer/9267555?hl=en x_refsource_MISC