Element
Element develops a focused real-time communication platform centered on its Element messaging application and desktop client, which operate in the decentralized Matrix ecosystem. The vendor's disclosed vulnerabilities cluster around session and data-handling issues such as insufficient information classification, resource exhaustion, session isolation, and information-exposure weaknesses, reflecting the multi-user and protocol-layer complexity of a federated chat system. Live severity, exploitation, and exposure counts are shown alongside this summary.
Trends Over Time
The number and severity of CVEs published that impact products developed by Element over time
Products(3 total)
Top CVEs
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-26131HIGH Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start | Feb 29, 2024 | 7.8 | 26 | NO | NO |
CVE-2022-41904MEDIUM Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established di | Nov 11, 2022 | 6.5 | 23 | NO | NO |
CVE-2022-23597HIGH Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user intera | Feb 1, 2022 | 8.8 | 22 | NO | NO |
CVE-2026-45078MEDIUM Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, local authenticated users can cause Synapse to starve other requests of CPU and lead to other requests | May 28, 2026 | 5.5 | 21 | NO | NO |
Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse fr | May 28, 2026 | 2.7 | 16 | NO | NO |
CVE-2025-27606MEDIUM Element Android is an Android Matrix Client provided by Element. Element Android up to version 1.6.32 can, under certain circumstances, fail to logout the user if they input the wr | Mar 14, 2025 | 4.6 | 16 | NO | NO |
Element Android is an Android Matrix Client. A third-party malicious application installed on the same phone can force Element Android, version 0.91.0 through 1.6.12, to share file | Feb 29, 2024 | 3.3 | 16 | NO | NO |
CVE Severity & Scoring
Exploit Exposure
Signals from CVEs in this vendor scope (7 CVEs).
Social Chatter
An overview of all social media posts that mention a CVE ID that affects a product developed by Element.
Media Mentions
Media articles that mention a CVE ID that affects a product developed by Element — matched by CVE ID, not by vendor name.