CVE-2024-26131

Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

• CWE-923
• CWE-940

• https://element.io/blog/security-release-element-android-1-6-12Release Notes
• https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9Patch
• https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vmPatch, Vendor Advisory
• https://support.google.com/faqs/answer/9267555?hl=enTechnical Description
• https://element.io/blog/security-release-element-android-1-6-12Release Notes
• https://github.com/element-hq/element-android/commit/53734255ec270b0814946350787393dfcaa2a5a9Patch
• https://github.com/element-hq/element-android/security/advisories/GHSA-j6pr-fpc8-q9vmPatch, Vendor Advisory
• https://support.google.com/faqs/answer/9267555?hl=enTechnical Description

Published

Feb 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26126Adobe Experience Manager versions 6.5.20 and earlier are aff…3.5
• CVE-2024-26127Adobe Experience Manager versions 6.5.20 and earlier are aff…3.5
• CVE-2024-26128baserCMS is a website development framework. Prior to versio…5.4
• CVE-2024-26129PrestaShop is an open-source e-commerce platform. Starting i…5.3
• CVE-2024-2613Data was not properly sanitized when decoding a QUIC ACK fra…7.5
• CVE-2024-26130cryptography is a package designed to expose cryptographic p…7.5
• CVE-2024-26132Element Android is an Android Matrix Client. A third-party m…3.3
• CVE-2024-26133EventStoreDB (ESDB) is an operational database built to stor…4.9
• CVE-2024-26134cbor2 provides encoding and decoding for the Concise Binary …7.5
• CVE-2024-26135MeshCentral is a full computer management web site. Versions…8.8
• CVE-2024-26136kedi ElectronCord is a bot management tool for Discord. Comm…7.5
• CVE-2024-26138The XWiki licensor application, which manages and enforce ap…5.3