Element X iOS EUVD-2026-104524

Two concrete conditions must both hold: (1) the attacker must trick the user into opening a maliciously crafted io.element.call:// URL (a custom scheme deep link), and (2) the victim must have PREVIOUSLY granted Element X iOS device microphone and camera permissions - without that prior grant the attacker-controlled origin loaded in the WKWebView receives no media access. Affected versions are Element X iOS before 26.05.0. Limiting factors: active user interaction is mandatory (the link must be opened), the media-capture impact depends entirely on a pre-existing permission grant, and the issue is specific to the iOS client, materially reducing realistic risk below what the network attack vector alone suggests.

This is a genuine but moderate-severity privacy flaw, not a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:L) scores 5.1 (Medium): network-reachable via a custom URL scheme, low complexity, no authentication, but it is gated by active user interaction (UI:A) and yields only low confidentiality impact (VC:N for integrity/availability). Crucially, real-world impact is further constrained by a precondition not captured in the raw score - the victim must have PREVIOUSLY granted Element X iOS camera/microphone permissions, otherwise the loaded attacker origin gets nothing. There is no CISA KEV listing, no EPSS score supplied, and no public proof-of-concept referenced, so exploitation status is: no public exploit identified at time of analysis. The combination of required social engineering (tricking a user into opening a crafted deep link) plus a pre-existing permission grant makes mass, automatable exploitation unlikely; this is better characterized as a targeted eavesdropping/origin-spoofing risk against specific users rather than a wormable or widespread threat. The source-code diff confirms the fix is real (the generic call-link parser and route were removed entirely), so the vulnerability itself is well-substantiated even though exploitation signals are absent.

An attacker crafts a malicious io.element.call:// deep link pointing at an attacker-controlled origin and delivers it to a victim via a chat message, email, or web page. When a victim who has previously granted Element X iOS camera and microphone access taps the link, the app skips the URL allowlist check and loads the attacker's origin inside the call screen's WKWebView, which inherits those device permissions and can spoof the call UI or capture audio/video. No public exploit identified at time of analysis, and the attack requires active user interaction.