element-hq / element-hq/element-android
Leak of communication content in Recent apps and during animations without providing pin
- Dominant language
- Kotlin
- Stars
- 3.7k
- Forks
- 917
- PR merge metrics
- No merged PRs in 30d
Description
### Steps to reproduce
1. Set up pin
2. Open conversation
3. Press home button on nav bar
4. Lock screen
5. Unlock screen
6. Press Recent button on nav bar
7. You can see last conversation content without providing pin

Another way
1. Do steps 1-5
2. Press on app icon
3. During animation of filling whole screen, content of last convo is visible, just before asking for pin
( I recommend record screen and watch it in slow motion)

Yet another way
1. Set up pin
2. Open conversation
4. Lock screen
5. Unlock screen
Again, just before pin prompt shows, conversation is visible for very short period of time. Try record with other phone/camera and play in slow motion
### Outcome
#### What did you expect?
Protect conversation content with pin.
#### What happened instead?
Aapp leaks conversation content in specific situations without providing a pin
### Your phone model
pixel 5
### Operating system version
Android 13 (CalyxOS)
### Application version and app store
Element 1.5.25, Aurora store 4.1.1
### Homeserver
matrix.org
### Will you send logs?
No
### Are you willing to provide a PR?
No
Contributor guide
Assessment
This issue has not been assessed yet.