CVE-2024-26131

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-923 CWE-940

Affected software

Vendor	Product	Versions
element-hq	element-android	>= 1.4.3, < 1.6.12

References

https://element.io/blog/security-release-element-android-1-6-12Release Notes
https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9Patch
https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vmPatch, Vendor Advisory
https://support.google.com/faqs/answer/9267555?hl=enTechnical Description
https://element.io/blog/security-release-element-android-1-6-12Release Notes
https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9Patch
https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vmPatch, Vendor Advisory
https://support.google.com/faqs/answer/9267555?hl=enTechnical Description

Timeline

Published: Feb 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-261323.3Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, vers CVE-2024-261334.9EventStoreDB (ESDB) is an operational database built to store events. A vulnerability has been identified in the projections subsystem in ve CVE-2024-261347.5cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in versio CVE-2024-261358.8MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within t CVE-2024-261367.5kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in t CVE-2024-261385.3The XWiki licensor application, which manages and enforce application licenses for paid extensions, includes the document `Licenses.Code.Lic CVE-2024-261398.1OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack o CVE-2024-26148.8Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption CVE-2024-261406.1com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a malic CVE-2024-261417.5Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large respon CVE-2024-261427.5Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routin CVE-2024-261436.1Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applica