CVE-2025-27599

6.5 mediumEPSS 0.4%

Medium (6.5). EPSS 0.4% chance of exploitation in the next 30 days.

Element X Android is a Matrix Android Client provided by element.io. Prior to version 25.04.2, a crafted hyperlink on a webpage, or a locally installed malicious app, can force Element X up to version 25.04.1 to load a webpage with similar permissions to Element Call and automatically grant it temporary access to microphone and camera. This issue has been patched in version 25.04.2.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
CWEs: CWE-20, CWE-926
Published: 2025-04-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/element-hq/element-x-android/commit/dc058544d7e693c04298191c1aadd5b39c9be52e
https://github.com/element-hq/element-x-android/releases/tag/v25.04.2
https://github.com/element-hq/element-x-android/security/advisories/GHSA-m5px-pwq3-4p5m

Check your stack JSON