CVE-2024-26131
📋 TL;DR
Element Android versions 1.4.3 through 1.6.10 are vulnerable to intent redirection, allowing malicious apps to launch internal activities with arbitrary parameters. This could enable attackers to display malicious web pages, bypass PIN protection, or steal login credentials via spoofed login screens. All Android users running vulnerable Element versions are affected.
💻 Affected Systems
- Element Android
📦 What is this software?
Element by Element
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover by intercepting login credentials sent to attacker-controlled servers, combined with PIN bypass and arbitrary JavaScript execution.
Likely Case
Malicious apps tricking users into entering credentials on spoofed login screens or displaying phishing pages within the app.
If Mitigated
Limited impact if users only install apps from trusted sources and maintain updated devices, though risk remains from sideloaded malicious apps.
🎯 Exploit Status
Exploitation requires a malicious Android app installed on the same device; no authentication needed within Element.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.12
Vendor Advisory: https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vm
Restart Required: Yes
Instructions:
1. Open Google Play Store 2. Search for 'Element' 3. Tap 'Update' if available 4. Alternatively, download directly from element.io 5. Restart the app after update
🧯 If You Can't Patch
- Uninstall Element Android and use web or desktop versions temporarily
- Disable app installation from unknown sources in Android settings
🔍 How to Verify
Check if Vulnerable:
Open Element Android app → Settings → About → Check if version is between 1.4.3 and 1.6.10 inclusiveCheck Version:
Not applicable for Android apps; check via app settingsVerify Fix Applied:
Confirm app version is 1.6.12 or higher in Settings → About📡 Detection & Monitoring
Log Indicators:
- Unusual activity launches from external intents
- Unexpected web page loads within the app
Network Indicators:
- Connections to non-standard Matrix servers during login
- Unexpected JavaScript execution from external sources
SIEM Query:
Not typically applicable for mobile app vulnerabilities🔗 References
- https://element.io/blog/security-release-element-android-1-6-12
- https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9
- https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vm
- https://support.google.com/faqs/answer/9267555?hl=en
- https://element.io/blog/security-release-element-android-1-6-12
- https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9
- https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vm
- https://support.google.com/faqs/answer/9267555?hl=en
