Element X iOS URL Allowlist Bypass in Call Screen

Executive Summary

Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call:// URLs. This allows an attacker to trick users into opening a malicious URL that loads an attacker-controlled origin in the call screen's WKWebView. If the user previously granted microphone and camera permissions, the attacker can gain access to these device resources.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious io.element.call:// URLs bypassing URL allowlist checks in Element X iOS versions before 26.05.0. Detection requires checking installed app versions and monitoring for suspicious URL handling. Inspect network traffic for unexpected io.element.call:// requests or WKWebView loads from untrusted origins. Check app logs for unauthorized camera or microphone access attempts.

Useful 0 Not Useful 0

Impact Analysis

If you use Element X iOS before version 26.05.0, an attacker could exploit this to gain access to your device's microphone and camera by tricking you into opening a malicious io.element.call:// URL. This could lead to unauthorized audio or video recording without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially violate GDPR and HIPAA by allowing unauthorized access to microphone and camera permissions. If an attacker exploits this flaw, they may gain access to sensitive audio or video data without proper consent, which conflicts with GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update Element X iOS to version 26.05.0 or later immediately. Disable io.element.call:// URL scheme handling if possible. Revoke microphone and camera permissions for Element X iOS in device settings until updated. Avoid clicking on any io.element.call:// links from untrusted sources.

Useful 0 Not Useful 0