element-hq / element-hq/element-android

Leak of communication content in Recent apps and during animations without providing pin

Open
#8,143 2 comments 0 reactions 0 assignees View on GitHub
A-Pin code O-Uncommon S-Minor Security T-Enhancement
Dominant language
Kotlin
Stars
3.7k
Forks
917
PR merge metrics
No merged PRs in 30d

Description

### Steps to reproduce

1. Set up pin
2. Open conversation
3. Press home button on nav bar
4. Lock screen
5. Unlock screen
6. Press Recent button on nav bar
7. You can see last conversation content without providing pin

![obraz](https://user-images.githubusercontent.com/40685260/219706615-c3a0acb1-6dd0-4b5d-b998-0bc56e0343ce.png)

Another way
1. Do steps 1-5
2. Press on app icon
3. During animation of filling whole screen, content of last convo is visible, just before asking for pin
( I recommend record screen and watch it in slow motion)

![obraz](https://user-images.githubusercontent.com/40685260/219706787-4aec5159-9b74-450a-bac3-c2928567ac64.png)

Yet another way
1. Set up pin
2. Open conversation
4. Lock screen
5. Unlock screen
Again, just before pin prompt shows, conversation is visible for very short period of time. Try record with other phone/camera and play in slow motion

### Outcome

#### What did you expect?

Protect conversation content with pin.

#### What happened instead?

Aapp leaks conversation content in specific situations without providing a pin

### Your phone model

pixel 5

### Operating system version

Android 13 (CalyxOS)

### Application version and app store

Element 1.5.25, Aurora store 4.1.1

### Homeserver

matrix.org

### Will you send logs?

No

### Are you willing to provide a PR?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.