CVE-2026-54521: FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)

Q: Which users are practically exposed to this issue?

Recipients using FairEmail versions before 1.2319 are exposed if they receive a crafted AMP email, open it, and enable the AMP toggle. Practical exposure is reduced because AMP email is uncommon.

Q: What does an attacker need to do to exploit it?

An attacker needs to send a crafted AMP email containing untrusted HTML that bypasses the incomplete sanitization. Exploitation also requires the recipient to interact with the message by enabling AMP rendering.

Q: What can malicious JavaScript do after exploitation?

The script can read the rendered message DOM, exfiltrate message data, and display phishing overlays within the message-body area. The stated impact does not include availability loss.

Q: What should users do if they cannot immediately update?

Do not enable the AMP toggle for untrusted or unexpected messages. Updating FairEmail to version 1.2319 resolves the issue.

Published Sep 17, 2026

Updated

FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr("src") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. The script can read the message DOM, exfiltrate message data, and display phishing overlays within the message-body area. Exploitation requires the recipient to enable the AMP toggle, and practical exposure is reduced because AMP email is uncommon. This issue is fixed in version 1.2319.

Affected Software

1 affected component

FairEmail<1.2319

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FairEmail to a version that resolves this vulnerability.
Fixed in 1.2319

Event History

Sep 17, 2026

CVE Published

via MITRE·08:17 PM

Data Sourced

via MITRE·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users are practically exposed to this issue?

Recipients using FairEmail versions before 1.2319 are exposed if they receive a crafted AMP email, open it, and enable the AMP toggle. Practical exposure is reduced because AMP email is uncommon.

What does an attacker need to do to exploit it?