Denial of Service via a Malformed OIDC Redirect Intent

Description

override fun parse(url: String): OAuthAction? {
    if (url.startsWith(oAuthRedirectUrlProvider.provide()).not()) return null
    if (url.contains("error=access_denied")) return OAuthAction.GoBack()
    if (url.contains("code=")) return OAuthAction.Success(url)

    // Other case not supported, let's crash the app for now
    error("Not supported: $url")
}

MainActivity.onNewIntent()
  -> MainNode.handleIntent()            [lifecycleScope.launch, no CoroutineExceptionHandler]
    -> RootFlowNode.handleIntent()
      -> IntentResolver.resolve()
        -> DefaultOAuthIntentResolver.resolve()
          -> DefaultOAuthUrlParser.parse()
            -> error("Not supported: $url")

<!--
  OAuth redirection
-->
<intent-filter>
    <action android:name="android.intent.action.VIEW" />

    <category android:name="android.intent.category.DEFAULT" />
    <category android:name="android.intent.category.BROWSABLE" />

    <data android:scheme="@string/login_redirect_scheme" />
</intent-filter>

FATAL EXCEPTION: main
Process: io.element.android.x, PID: 4800
java.lang.IllegalStateException: Not supported: io.element.android:/?state=...
    at io.element.android.libraries.oauth.impl.DefaultOAuthUrlParser.parse(OAuthUrlParser.kt:42)

override fun parse(url: String): OAuthAction? {
    if (url.startsWith(oAuthRedirectUrlProvider.provide()).not()) return null
    if (url.contains("error=access_denied")) return OAuthAction.GoBack()
    if (url.contains("code=")) return OAuthAction.Success(url)

    // Other cases are not supported, log an error and return null
    Timber.w("Unsupported OAuth url")
    return null
}

Impact

• Any application installed on the device can crash Element X Android whenever it chooses, with no Android permission and no user interaction. A web page does the same when the user taps a link. The messenger stays unavailable for as long as the attacking application keeps sending the intent.
• The failure mode matters more than the individual crash. An application that re-fires the intent on a timer makes the messenger unusable without ever touching its data, and the person using the device gets no indication of which installed application is responsible. Timing the crash to the moment the messenger is opened is also possible, but that variant needs the user-granted PACKAGE_USAGE_STATS permission to read the foreground app; the untimed version needs none. We confirmed both against Element X Android v26.03.3 from the Play Store on Android 15.
• No message content, key material, or account data is exposed. The impact is availability only, and it lands on the user rather than on the homeserver.

Mitigation

Update Element X Android to 26.06.2 or later. The fix replaces the error() call with a log line and a null return, which the caller already handles as an unrecognized URL. There is no configuration-level workaround for earlier versions: the intent filter has to stay exported for the OIDC login flow to work at all.

Defender's Checklist

• Update to Element X Android 26.06.2 or later.

  Every earlier release with OIDC support is affected, across the release, debug, and nightly schemes.

• Do not wait for a workaround.

  The OIDC redirect intent filter has to stay exported for login to work, so no configuration closes this without the code fix. Fleet-managed deployments should treat the update as required rather than optional.

• Audit forks for the same pattern.

  Applications built on the Element X Android codebase inherit the parser. Grep for error( on any path reachable from an exported intent filter: an IllegalStateException on an attacker-supplied URL is a crash, not a guard.

• Review your other exported entry points.

  The root cause is an error() call standing in for an unhandled case on a path that later became externally reachable. Any exported activity, receiver, or provider that parses attacker-supplied data deserves the same review, including the ones whose unit tests currently assert that they throw.

Severity Reasoning

References

• GHSA-r4f9-46vw-v7g3 (Element)
• CVE-2026-55080 (NVD)
• Element X Android v26.06.2 Release
• Element X Android Repository
• CVE-2025-27599 (NVD, AV:N scoring precedent for the same exported intent filter)
• Related: Element Web HTML injection via the homeserver-controlled home page URL

How We Can Help

• Security Architecture Review
• MDR Penetration Testing