CVE-2025-27599: Element X Android Auth Bypass Vulnerability

CVE-2025-27599 Overview

CVE-2025-27599 affects Element X Android, a Matrix client developed by element.io. Prior to version 25.04.2, the application improperly validated URLs handed to its Element Call component. A crafted hyperlink on a webpage or a locally installed malicious application can force Element X up to version 25.04.1 to load an arbitrary webpage under the same permission context as Element Call. That context automatically grants temporary access to the device microphone and camera. The vendor patched the flaw in version 25.04.2. The issue is tracked as CWE-20 Improper Input Validation.

Critical Impact
Attackers can trigger unauthorized microphone and camera access on affected Element X Android devices without user interaction, enabling covert eavesdropping through the Element Call surface.

Affected Products

Element X Android versions prior to 25.04.2
Element X Android up to and including 25.04.1
Matrix client integrations relying on the vulnerable CallIntentDataParser

Discovery Timeline

2025-04-18 - CVE-2025-27599 published to NVD
2025-04-18 - Element releases fixed version 25.04.2 and publishes advisory GHSA-m5px-pwq3-4p5m
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27599

Vulnerability Analysis

Element X Android exposes an in-app WebView-based Element Call surface. That surface accepts URLs through Android intents, custom URI schemes, and inbound hyperlinks. The parser in CallIntentDataParser.kt decides whether a URL should be loaded with Element Call privileges. Those privileges include automatic microphone and camera grants for the loaded origin. The parser did not restrict URLs supplied through the element://call and io.element.call:// custom schemes to trusted hosts. An attacker who can deliver a crafted hyperlink or run a malicious application on the device can supply an arbitrary https URL through those schemes. The application then loads attacker-controlled content inside the privileged Element Call context. The loaded page inherits the runtime permissions already granted to Element Call and can activate the microphone and camera without a further consent prompt.

Root Cause

The root cause is missing host allow-listing on URLs passed through custom scheme handlers. The parser trusted any HTTP(S) target embedded inside element://call or io.element.call:// deep links. No verification tied the final loaded host to call.element.io or another approved origin.

Attack Vector

Delivery paths include a crafted hyperlink rendered in a browser or messenger, a scannable QR code, or a locally installed malicious Android application that dispatches an intent to Element X. User interaction is not required beyond opening the link, matching the network attack vector described in the CVSS metrics.

kotlin

 class CallIntentDataParser @Inject constructor() {
     private val validHttpSchemes = sequenceOf("https")
+    private val knownHosts = sequenceOf(
+        "call.element.io",
+    )
 
     fun parse(data: String?): String? {
         val parsedUrl = data?.let { Uri.parse(data) } ?: return null
         val scheme = parsedUrl.scheme
         return when {
-            scheme in validHttpSchemes && parsedUrl.host == "call.element.io" -> parsedUrl
+            scheme in validHttpSchemes -> parsedUrl
             scheme == "element" && parsedUrl.host == "call" -> {
-                // We use this custom scheme to load arbitrary URLs for other instances of Element Call,
-                // so we can only verify it's an HTTP/HTTPs URL with a non-empty host
                 parsedUrl.getUrlParameter()
             }
             scheme == "io.element.call" && parsedUrl.host == null -> {
-                // We use this custom scheme to load arbitrary URLs for other instances of Element Call,
-                // so we can only verify it's an HTTP/HTTPs URL with a non-empty host
                 parsedUrl.getUrlParameter()
             }
             else -> null
-        }?.withCustomParameters()
+        }
+            ?.takeIf { it.host in knownHosts }
+            ?.withCustomParameters()
     }

Source: GitHub commit dc058544. The patch introduces a knownHosts allow-list and enforces it with takeIf { it.host in knownHosts } before returning the parsed URL.

Detection Methods for CVE-2025-27599

Indicators of Compromise

Element X Android sessions loading URLs outside call.element.io inside the Element Call WebView
Intents dispatched to Element X carrying element://call?url=... or io.element.call://?url=... with non-Element hosts
Unexpected microphone or camera activation events on Android devices immediately after opening a hyperlink
Installation of untrusted third-party APKs shortly before anomalous Element X activity

Detection Strategies

Inspect Android application logs for CallIntentDataParser handling URLs with hosts other than call.element.io
Correlate RECORD_AUDIO and CAMERA permission usage events with Element X foreground activity in mobile telemetry
Alert on installations of Element X versions at or below 25.04.1 in mobile device management inventories

Monitoring Recommendations

Track Element X Android version distribution across managed devices and flag anything below 25.04.2
Monitor DNS and HTTP egress from mobile fleets for connections to unexpected hosts through the Element Call user agent
Review MDM logs for intent broadcasts targeting the io.element.android.x package that carry embedded URLs

How to Mitigate CVE-2025-27599

Immediate Actions Required

Upgrade all Element X Android installations to version 25.04.2 or later
Remove or block Element X Android builds at or below 25.04.1 through mobile device management
Audit devices for recently installed applications that could deliver crafted intents to Element X
Instruct users to avoid opening element://call and io.element.call:// links from untrusted sources until patched

Patch Information

Element released the fix in Element X Android v25.04.2. The patch is described in GitHub Security Advisory GHSA-m5px-pwq3-4p5m and implemented in commit dc058544. The fix enforces an allow-list of trusted hosts before loading URLs into the Element Call context.

Workarounds

Restrict which browsers and messaging apps can hand off links to Element X through Android default-app settings
Disable installation of applications from unknown sources on affected devices
Use MDM policies to prevent side-loading until all endpoints run version 25.04.2 or later

bash

# Verify installed Element X Android version through adb
adb shell dumpsys package io.element.android.x | grep versionName
# Expected output for patched devices:
# versionName=25.04.2