PT-2024-21290 · Element · Element Android

Smaury + 2 · Published 2024-02-20 · Updated 2025-10-31 · CVE-2024-26131

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Element Android versions 1.4.3 through 1.6.10

Description The issue allows a third-party malicious application to start any internal activity by passing some extra parameters, potentially making Element Android display an arbitrary web page, executing arbitrary JavaScript, bypassing PIN code protection, and enabling account takeover by spawning a login screen to send credentials to an arbitrary home server.

Recommendations For Element Android versions 1.4.3 through 1.6.10, update to version 1.6.12 to resolve the issue. At the moment, there is no known workaround to mitigate the issue for these versions.

Exploit

Fix

Weakness Enumeration

CWE-923

CWE-940

Related Identifiers

CVE-2024-26131

GHSA-J6PR-FPC8-Q9VM

Affected Products

Element Android

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26131.json · Exploit
• https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vm · Vendor Advisory
• https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9 · Patch
• https://osv.dev/vulnerability/CVE-2024-26131 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26131 · Security Note
• https://twitter.com/cr0n0sh4/status/1781151717406445849 · Twitter Post
• https://t.me/cybersecuritytechnologies/10433 · Telegram Post
• https://t.me/rnetsec/20272 · Telegram Post
• https://element.io/blog/security-release-element-android-1-6-12 · Note
• https://twitter.com/CVEnew/status/1760010977024594051 · Twitter Post
• https://twitter.com/xvonfers/status/1760093166706036900 · Twitter Post
• https://twitter.com/payloadartist/status/1781024892260888843 · Twitter Post
• https://t.me/defcon_news/123030 · Telegram Post
• https://twitter.com/Bug_X_hunter/status/1786252454029631833 · Twitter Post
• https://t.me/cvenotify/111459 · Telegram Post