Element Web EUVD-2026-64046

Exploitation requires the attacker to control or have compromised the specific Matrix homeserver that the victim's Element Web instance is configured to use - this vulnerability is not exploitable by arbitrary network attackers against default configurations of independent deployments. The user must have their Element Web homepage load in the browser, which occurs on normal client startup (passive interaction, not deliberate user action beyond opening the app). No authentication to Element Web is required on the attacker's side; the homeserver-side access is the prerequisite. The enforced Content Security Policy prevents JavaScript execution from the injected HTML, limiting the attack surface to HTML and CSS phishing payloads. Self-hosted homeserver deployments with weak server-side security postures and publicly federated servers whose homepage endpoints can be influenced are at elevated risk relative to managed SaaS deployments where homeserver infrastructure is controlled by a trusted operator.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N) scoring 5.3 Medium accurately reflects the constrained impact profile: network-delivered, low complexity, but limited to low confidentiality and integrity impact with no availability consequence. The critical limiting factor is the homeserver trust relationship - this is not exploitable by arbitrary internet attackers; the threat actor must control or have compromised the specific Matrix homeserver the victim is configured to use. EPSS data was not provided, so exploitation probability cannot be quantified. No CISA KEV listing and no identified public exploit code reduce urgency for most deployments. The realistic threat model is targeted phishing against users of compromised or adversary-operated homeservers - the injected HTML renders with full browser fidelity in the trusted Element interface, making it a credible social engineering vector. The CSP boundary is a meaningful and confirmed partial control that prevents JavaScript execution, keeping this outside the critical tier despite unsanitized HTML rendering.

An attacker operating a rogue Matrix homeserver - or one who has gained write access to a legitimate homeserver's homepage endpoint configuration - serves a crafted HTML payload containing a spoofed Element session-expiry prompt with a credential-harvesting form. When a user running Element Web prior to 1.12.22 connects to that homeserver and the homepage loads, the injected HTML renders with full visual fidelity inside the trusted Element interface. Because CSP blocks JavaScript, the attacker relies on a plain HTML form submission to an attacker-controlled endpoint to capture Matrix credentials.