CVE-2026-55644: Element X iOS CSRF Vulnerability

CVE-2026-55644 Overview

Element X iOS, a Matrix client developed by Element, contains a URL allowlist bypass vulnerability in versions prior to 26.05.0. The application fails to validate URLs against its allowlist when parsing the io.element.call:// custom scheme. An attacker who tricks a user into opening a crafted io.element.call:// URL can load an attacker-controlled origin inside the call screen's WKWebView. The embedded web view inherits any previously granted microphone and camera permissions, enabling unauthorized access to device audio and video. The issue is tracked under [CWE-20] Improper Input Validation and was patched in Element X iOS version 26.05.0.

Critical Impact
An attacker-controlled web origin can execute inside the Element X call WKWebView with inherited microphone and camera permissions, enabling covert audio and video capture.

Affected Products

Element X iOS versions prior to 26.05.0
Matrix client functionality handling the io.element.call:// URL scheme
Call screen WKWebView component with granted media permissions

Discovery Timeline

2026-10-19 - CVE-2026-55644 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-55644

Vulnerability Analysis

Element X iOS registers a custom URL scheme, io.element.call://, that routes incoming links into an in-app call flow. The handler forwards the supplied URL to a WKWebView embedded in the call screen without validating the origin against the configured allowlist. Any origin passed through this scheme is rendered within an authenticated context that already holds device permissions.

Because iOS binds microphone and camera permissions to the app rather than individual web origins, the embedded WKWebView inherits these grants. An attacker who delivers a crafted link via chat, email, SMS, or a malicious web page can load an external origin that silently requests getUserMedia streams. The scope is limited to the single call screen context, which aligns with the medium severity rating.

Root Cause

The root cause is missing input validation on the URL passed to the generic call link handler. The pre-patch code path in AppCoordinator.swift invoked presentCallScreen(genericCallLink: url) or delegated to the user session flow coordinator without consulting the URL allowlist. The call widget driver (GenericCallLinkWidgetDriver.swift) then loaded the attacker-supplied origin directly into the WKWebView.

Attack Vector

Exploitation requires user interaction: the victim must open a maliciously crafted io.element.call:// link. Delivery vectors include Matrix room messages, external messengers, email, or any web page capable of triggering a custom URL scheme. Successful exploitation requires that the user has previously granted microphone and camera permissions to Element X iOS. No authentication to Element services is required to craft the link.

text

// Patch excerpt - ElementX/Sources/Application/AppCoordinator.swift
            case .accountProvisioningLink:
                handleAppRoute(route,
                               windowType: windowType)
-            case .genericCallLink(let url):
-                if let userSessionFlowCoordinator {
-                    userSessionFlowCoordinator.handleAppRoute(route, animated: true)
-                } else {
-                    presentCallScreen(genericCallLink: url)
-                }
            case .userProfile(let userID):
                if isExternalURL {
                    handleAppRoute(route,

Source: element-x-ios commit 63592e4. The fix removes the .genericCallLink route and the corresponding GenericCallLinkWidgetDriver.swift registration, eliminating the vulnerable code path entirely.

Detection Methods for CVE-2026-55644

Indicators of Compromise

Inbound links or messages containing the io.element.call:// URI scheme that reference origins outside the Element Call allowlist.
Mobile device management (MDM) telemetry showing Element X iOS installations with versions earlier than 26.05.0.
Unexpected microphone or camera activation events on iOS devices correlated with Element X foreground activity.

Detection Strategies

Inspect message gateway and email security logs for URLs beginning with io.element.call:// that point to unknown hosts.
Audit installed application inventories through MDM to flag Element X iOS builds below 26.05.0.
Correlate iOS privacy indicators (microphone and camera dot) with Element X session telemetry for anomalies.

Monitoring Recommendations

Enable URL filtering on mobile email and messaging platforms to quarantine messages carrying unknown custom scheme payloads.
Track application version compliance in endpoint management dashboards and alert on devices lagging the patched release.
Review Matrix homeserver logs for inbound messages containing crafted call links delivered to multiple recipients.

How to Mitigate CVE-2026-55644

Immediate Actions Required

Upgrade Element X iOS to version 26.05.0 or later through the App Store or MDM-managed deployment channels.
Instruct users to avoid tapping unsolicited io.element.call:// links received from untrusted senders.
Review microphone and camera permissions granted to Element X iOS and revoke if the application is not actively used for calls.

Patch Information

The vendor released the fix in Element X iOS release 26.05.0. The patch, delivered through pull request #5515 and commit 63592e4, removes in-app handling of SPA (single-page application) call links entirely. Full details are available in the GHSA-54w7-rw44-49m7 security advisory.

Workarounds

Temporarily revoke Element X iOS microphone and camera permissions in iOS Settings until the update is installed, which prevents the embedded WKWebView from accessing media devices.
Use MDM configuration profiles to block or warn on custom URL schemes handled by vulnerable Element X iOS builds.
Instruct users to open call invitations exclusively from within the Element X application rather than through external links.

bash

# Verify installed Element X iOS version via MDM query (example)
# Expected minimum version: 26.05.0
mdm-cli query --app "io.element.elementx" --field CFBundleShortVersionString