CVE-2026-54521

MediumCVSS 6.1

Published: 17/09/2026(UTC)Updated: 23/09/2026(UTC)Translated: 18/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

23th percentile - higher than 23% of all known CVEs

Summary

FairEmail is an open source email app for Android. The ActivityAMP AMP message renderer enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr("src") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. This issue is fixed in version 1.2319.

Risk Assessment

The script can read the message DOM, exfiltrate message data, and display phishing overlays within the message-body area. The risk is reduced because AMP email is uncommon and exploitation requires the recipient to enable the AMP toggle.

Recommendation

Update FairEmail to version 1.2319 or later. Exercise caution when enabling the AMP toggle for messages from untrusted sources.

Other vulnerabilities in FairEmail

CVE-2026-68509Medium
In FairEmail prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can supply path components that escape the shared attachment directory and overwrite files in the FairEmail private data directory.

Original NVD description (English source)

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr("src") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. The script can read the message DOM, exfiltrate message data, and display phishing overlays within the message-body area. Exploitation requires the recipient to enable the AMP toggle, and practical exposure is reduced because AMP email is uncommon. This issue is fixed in version 1.2319.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS