Element X iOS before version 26.05.0 fails to enforce the URL allowlist when processing the io.element.call:// deeplink scheme. If a malicious user tricks a victim into opening a specially crafted deeplink, the application loads the attacker‑controlled HTTPS origin inside a WKWebView placed on the call screen. This web view inherits any microphone or camera permissions the user has already granted to Element X iOS and can capture audio or video without the user’s awareness.

The affected product is Element X iOS from Element HQ. All installations running any version prior to 26.05.0 are vulnerable, regardless of regional or platform variations within the iOS ecosystem.

The CVSS score of 5.1 indicates moderate severity, but the EPSS score is unavailable and the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector is social engineering: the attacker must persuade a user to open the malicious deeplink after the user has already granted camera/microphone permissions. While the exploit path is straightforward for a victim who engages with the deeplink, no additional technical exploitation steps are required beyond this social manipulation, making it a realistic threat for unsuspecting users.