PT-2025-17307 · Element · Element

Davidegirardi · Published 2025-04-18 · Updated 2025-04-18 · CVE-2025-27599

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Element X Android versions prior to 25.04.2

Description A crafted hyperlink on a webpage or a locally installed malicious app can force Element X to load a webpage with similar permissions to Element Call, automatically granting it temporary access to the microphone and camera.

Recommendations For versions prior to 25.04.2, update to version 25.04.2 to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-926

Related Identifiers

CVE-2025-27599

GHSA-M5PX-PWQ3-4P5M

Affected Products

Element

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27599.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-27599 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27599 · Security Note
• https://github.com/element-hq/element-x-android/releases/tag/v25.04.2 · Note
• https://github.com/element-hq/element-x-android/security/advisories/GHSA-m5px-pwq3-4p5m · Note
• https://github.com/element-hq/element-x-android/commit/dc058544d7e693c04298191c1aadd5b39c9be52e · Note
• https://t.me/cvetracker/21926 · Telegram Post
• https://t.me/cvedetector/23322 · Telegram Post
• https://twitter.com/CVEnew/status/1913312937294623082 · Twitter Post