Element Web vulnerable to potential exposure of access token via authenticated media

Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

Element allows a malicious homeserver can modify events leading to unrenderable events or rooms

Element Web could load a malicious instance of Element Call leaking media encryption keys

Element's thumbnails can be abused to misrepresent the content of an attachment

In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left