# CVE-2026-55644: Element X iOS URL allowlist bypass in call handler

Source: https://junglewise.ai/threats/cve-2026-55644-element-x-ios-is-a-matrix-ios-client-provided-by-element-element  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-55644 · Severity: info · Published 2026-10-19

Element X iOS is a messaging client for the Matrix network. A flaw in how the app processes io.element.call:// links allows an attacker to trick users into loading a malicious website inside the call screen, potentially gaining access to the device's microphone and camera if the user previously granted those permissions to the app.

Vendors: [Element](https://junglewise.ai/threats/vendors/element).

## Quick answers

**Is CVE-2026-55644 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55644 being exploited in the wild.

**How severe is CVE-2026-55644?** Informational severity, published 19 October 2026.

**Which products and versions are affected?** Element X iOS before 26.05.0.

**Is there a fix for CVE-2026-55644?** Yes: fixed in 26.05.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55644 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55644?** Check whether you run Element X iOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.05.0

## Technical details

Element X iOS fails to validate URLs against an allowlist when parsing io.element.call:// deep links before loading them in a WKWebView. An attacker can craft a malicious io.element.call:// link that, when opened by a user, loads an attacker-controlled origin within the call screen and inherits the microphone and camera permissions previously granted to the application. The vulnerability requires user interaction (clicking a link) and existing permission grants to be exploitable.

## Affected products

- Element Element X iOS before 26.05.0

## Timeline

- 2026-04-29: patched: SPA call link support removed in commit 63592e48
- 2026-10-19: disclosed

## References

- [https://github.com/element-hq/element-x-ios/commit/63592e48c1a1e47f75693045efd85a7d4468ea84](https://github.com/element-hq/element-x-ios/commit/63592e48c1a1e47f75693045efd85a7d4468ea84)
- [https://github.com/element-hq/element-x-ios/pull/5515](https://github.com/element-hq/element-x-ios/pull/5515)