Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-54521

FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)

CVSS 3.1 6.1 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-54521

Published

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr("src") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. The script can read the message DOM, exfiltrate message data, and display phishing overlays within the message-body area. Exploitation requires the recipient to enable the AMP toggle, and practical exposure is reduced because AMP email is uncommon. This issue is fixed in version 1.2319.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-54521

Published

FairEmail

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "M66B",
                    "product": "FairEmail",
                    "versions": [
                        {
                            "version": "< 1.2319",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON