Is CVE-2026-55644 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55644 being exploited in the wild.

How severe is CVE-2026-55644?

Informational severity, published 19 October 2026.

Is there a fix for CVE-2026-55644?

Yes: fixed in 26.05.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55644 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55644?

Check whether you run Element X iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55644: Element X iOS URL allowlist bypass in call handler

CVE-2026-55644 · Severity: info · Published 2026-10-19

Element X iOS is a messaging client for the Matrix network. A flaw in how the app processes io.element.call:// links allows an attacker to trick users into loading a malicious website inside the call screen, potentially gaining access to the device's microphone and camera if the user previously granted those permissions to the app.

Vendors: Element.

Quick answers

Is CVE-2026-55644 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55644 being exploited in the wild.
How severe is CVE-2026-55644?: Informational severity, published 19 October 2026.
Which products and versions are affected?: Element X iOS before 26.05.0.
Is there a fix for CVE-2026-55644?: Yes: fixed in 26.05.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55644 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55644?: Check whether you run Element X iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.05.0

Technical details

Element X iOS fails to validate URLs against an allowlist when parsing io.element.call:// deep links before loading them in a WKWebView. An attacker can craft a malicious io.element.call:// link that, when opened by a user, loads an attacker-controlled origin within the call screen and inherits the microphone and camera permissions previously granted to the application. The vulnerability requires user interaction (clicking a link) and existing permission grants to be exploitable.

Affected products

Element Element X iOS before 26.05.0

Timeline

2026-04-29: patched: SPA call link support removed in commit 63592e48
2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.