CVE-2024-26132

CVE-2024-26132 affects Element Android versions 0.91.0 through 1.6.12, allowing a malicious third-party application on the same device to force Element Android to share files from its private data directory to an arbitrary Matrix room. The vulnerability has a low CVSS score of 3.3, indicating a local attack vector with low complexity and limited impact, primarily exposing unencrypted sensitive data like FCM tokens. While the databases are encrypted, other potentially sensitive information could be leaked. There is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, though it has received some community discussion. The issue is fixed in Element Android 1.6.12, and no workaround exists.