Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-54521FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)

Medium 6.1

In plain English

A medium-severity cross-site scripting in FairEmail from M66B. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.3%top 74.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr("src") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. The script can read the message DOM, exfiltrate message data, and display phishing overlays within the message-body area. Exploitation requires the recipient to enable the AMP toggle, and practical exposure is reduced because AMP email is uncommon. This issue is fixed in version 1.2319.

Affected products (as reported)

Vendor	Product	Versions
M66B	FairEmail	< 1.2319

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/M66B/FairEmail/security/advisories/GHSA-r8ff-qr7g-pvw6 x_refsource_CONFIRM
https://github.com/M66B/FairEmail/commit/fb37bbfabf5e75d08f0cfa6ce9b84469d62a20a0 x_refsource_MISC
https://github.com/M66B/FairEmail/releases/tag/1.2319 x_refsource_MISC