CVE-2026-55644 element-hq CVE debrief

Who should care

Element X iOS users and administrators should verify their version and apply patches to prevent potential exploitation. This includes reviewing and restricting io.element.call:// URL usage, monitoring for suspicious activity, and adjusting permissions as needed. Additionally, users should review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-55644 is a medium-severity vulnerability in Element X iOS that allows an attacker to control the HTTPS origin through a deeplink, potentially granting access to the device's microphone and camera. Users and administrators should verify their version and apply patches to prevent exploitation.

• Potential unauthorized access to device microphone and camera
• Possible exploitation through maliciously crafted URLs
• Need for verification of Element X iOS version and patch application
• Importance of monitoring for suspicious activity

Technical summary

Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing io.element.call://, allowing an attacker to load an attacker-controlled origin inside the call screen's WKWebView, potentially granting device microphone and camera permissions. This issue can be exploited through maliciously crafted URLs, and users are advised to verify their version and apply patches to prevent exploitation. The vulnerability affects Element X iOS versions prior to 26.05.0 and can be mitigated by applying the patch.

Defensive priority

Medium priority for Element X iOS users and administrators to verify and apply patches.

Recommended defensive actions

• Verify Element X iOS version and apply patch 26.05.0 or later
• Review and restrict io.element.call:// URL usage
• Monitor for suspicious activity and adjust permissions as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE Program record and NVD vulnerability detail provide information on the vulnerability. Supplemental sources include GitHub advisories and pull requests. The CVE record was published on 2026-10-19T17:54:58.499Z and has not been modified since then. The vulnerability has been patched in version 26.05.0, and users are advised to verify their version and apply patches to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.