CVE-2026-54521 in FairEmail
Summary
by MITRE • 09/18/2026
FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr("src") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. The script can read the message DOM, exfiltrate message data, and display phishing overlays within the message-body area. Exploitation requires the recipient to enable the AMP toggle, and practical exposure is reduced because AMP email is uncommon. This issue is fixed in version 1.2319.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified as a cross-site scripting flaw within FairEmail affects versions prior to 1.2319 and centers on the improper handling of untrusted input in the ActivityAMP module, specifically located at app/src/main/java/eu/faircode/email/ActivityAMP.java. This component serves as an AMP message renderer that utilizes Android WebView technology to display email content formatted according to the Accelerated Mobile Pages standard. The core technical deficiency lies in the incomplete sanitization of HTML attributes when processing messages from non-allowlisted hosts. While the implementation attempts to mitigate risks by removing script elements with a src attribute via script.removeAttr("src"), this approach is fundamentally flawed because it fails to address inline script blocks or other dangerous vector types. Consequently, malicious actors can inject arbitrary JavaScript code that remains executable within the WebView context despite the security controls intended to neutralize such threats.
From an operational perspective, this vulnerability allows for remote code execution in the form of client-side scripting attacks when a recipient opens a crafted AMP email and has the AMP toggle enabled. The attacker's script gains access to the message Document Object Model, enabling it to read sensitive content contained within the email body. Furthermore, the malicious JavaScript can exfiltrate personal data from the device or display phishing overlays that mimic legitimate interface elements, potentially tricking users into revealing credentials or other confidential information. Although the requirement for the user to manually enable the AMP toggle reduces the attack surface and practical exposure due to the relatively uncommon usage of AMP emails in standard communication workflows, the severity remains high because it bypasses expected security boundaries within a privacy-focused application designed to protect user data.
This issue aligns with Common Weakness Enumeration category CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The attack vector corresponds to ATT&CK technique T1059, specifically the execution of scripts within a web browser environment, and relates to data exfiltration techniques where sensitive information is stolen from the victim's device through malicious code execution. To mitigate this risk, users are advised to upgrade FairEmail immediately to version 1.2319 or later, which implements comprehensive input validation and stricter sanitization rules for AMP content. Additionally, administrators should enforce policies that discourage the use of unverified email clients until patches are applied and educate end-users about the risks associated with enabling advanced rendering features like AMP in incoming messages from unknown sources.