CVE-2026-55644— Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin
Quick assessment
Affected
element-hq element-x-ios
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Element X iOS 是由 Element 提供的 Matrix iOS 客户端。在 26.05.0 版本之前的 Element X iOS 中，解析 协议时未能检查 URL 白名单。如果攻击者能够诱使用户打开恶意构造的 URL，则可以在通话界面的 WKWebView 中加载由攻击者控制的源，并获取设备的麦克风和摄像头权限（前提是用户此前已授权 Element X iOS 使用这些权限）。该问题已在 26.05.0 版本中修复。
Possible ATT&CK Techniques 2 AI
T1566.001 · Spearphishing Attachment T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| element-hq | element-x-ios | < 26.05.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55644
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Element X iOS: io.element.call deeplink allows attacker-controlled HTTPS origin and may grant mic/camera to that origin
Source: CVE Program / CVE List V5
Vulnerability Description
Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://. If an attacker is able to trick the user into opening a maliciously crafted io.element.call:// URL, they are able to load an attacker-controlled origin inside the call screen's WKWebView which will be granted device microphone and camera permissions (provided the user has previously granted these permissions to Element X iOS). This issue has been patched in version 26.05.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| element-hq | element-x-ios | < 26.05.0 | - |
|
II. Public POCs for CVE-2026-55644
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55644
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55644 (1)
Vendor Advisories for CVE-2026-55644 (1)
Vendor Pages for CVE-2026-55644 (1)
-
🔗 Release 26.05.0 · element-hq/element-x-ios · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: element-hq
-
CVE-2026-55850
Element Web: A malicious homeserver can inject HTML in Eleme -
CVE-2026-48007
Element Call reports full URLs of visited pages to analytics -
CVE-2026-45078
Synapse CPU starvation (Denial of Service) -
CVE-2026-45076
Synapse pagination denial of service -
CVE-2026-24044
ESS Community Helm Chart has a weak server key generation me
Same weakness: CWE-20
-
CVE-2026-85314
Apache Camel: Camel-Mail Header Injection via Unfiltered mai -
CVE-2026-85312
Apache Camel: Camel-Core Saga Participation Hijacking via th -
CVE-2026-85249
Apache Camel: Camel-Tika Header Injection via Unfiltered Doc -
CVE-2026-76739
HPE Compute Scale-up Server 3200 and 3250 platforms and Supe -
CVE-2026-108121
Koozali - SME Server Improper Input Validation in domain Cre
V. Comments for CVE-2026-55644
No comments yet