CVE-2024-26132

Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through 1.6.12, to share files stored under the `files` directory in the application's private data directory to an arbitrary room. The impact of the attack is reduced by the fact that the databases stored in this folder are encrypted. However, it contains some other potentially sensitive information, such as the FCM token. Forks of Element Android which have set `android:exported="false"` in the `AndroidManifest.xml` file for the `IncomingShareActivity` activity are not impacted. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

• CWE-200

• https://element.io/blog/security-release-element-android-1-6-12Patch, Release Notes
• https://github.com/element-hq/element-android/commit/8f9695a9a8d944cb9b92568cbd76578c51d32e07Patch
• https://github.com/element-hq/element-android/security/advisories/GHSA-8wj9-cx7h-pvm4Patch, Vendor Advisory
• https://element.io/blog/security-release-element-android-1-6-12Patch, Release Notes
• https://github.com/element-hq/element-android/commit/8f9695a9a8d944cb9b92568cbd76578c51d32e07Patch
• https://github.com/element-hq/element-android/security/advisories/GHSA-8wj9-cx7h-pvm4Patch, Vendor Advisory

Published

Feb 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26127Adobe Experience Manager versions 6.5.20 and earlier are aff…3.5
• CVE-2024-26128baserCMS is a website development framework. Prior to versio…5.4
• CVE-2024-26129PrestaShop is an open-source e-commerce platform. Starting i…5.3
• CVE-2024-2613Data was not properly sanitized when decoding a QUIC ACK fra…7.5
• CVE-2024-26130cryptography is a package designed to expose cryptographic p…7.5
• CVE-2024-26131Element Android is an Android Matrix Client. Element Android…7.8
• CVE-2024-26133EventStoreDB (ESDB) is an operational database built to stor…4.9
• CVE-2024-26134cbor2 provides encoding and decoding for the Concise Binary …7.5
• CVE-2024-26135MeshCentral is a full computer management web site. Versions…8.8
• CVE-2024-26136kedi ElectronCord is a bot management tool for Discord. Comm…7.5
• CVE-2024-26138The XWiki licensor application, which manages and enforce ap…5.3
• CVE-2024-26139OpenCTI is an open source platform allowing organizations to…8.1