FairEmail CVE-2026-54521

Requires the FairEmail Android app prior to 1.2319 and, critically, the recipient must manually enable the per-message AMP toggle for the vulnerable ActivityAMP WebView renderer to run - AMP messages are not rendered by default. The attacker must craft an AMP-formatted email whose malicious payload uses vectors the pre-patch sanitizer misses: inline <script> element bodies (only [src] was stripped), on* event-handler attributes, or javascript: URLs on non-script elements, on a non-allowlisted host. Practical exposure is further limited because AMP email is uncommon; impact is confined to the message-body WebView (DOM read, message-data exfiltration, in-body phishing overlays) with no access to the device or account beyond the rendered message.

This is a genuine but modest-severity client-side XSS (CWE-79) in FairEmail's AMP message renderer, and the signals are internally consistent rather than conflicting. The vendor CVSS of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) is well-supported by the description and the confirmed source-code fix: the pre-patch ActivityAMP.java enabled JavaScript in the WebView but only stripped script[src] for non-allowlisted hosts, leaving inline <script> bodies, on* event-handler attributes, and javascript: URLs intact - exactly what the patch (element removal plus attribute stripping of on*/javascript:) now closes. No EPSS score, KEV entry, or public POC was provided, so exploitation status is 'no public exploit identified at time of analysis'; the fix commit does, however, implicitly document the bypass. Two strong real-world limiters keep this out of urgent-priority territory: exploitation requires the recipient to manually enable the per-message AMP toggle (UI:R), and AMP email itself is rare, so the delivery surface is small. Impact is also capped - attacker JS is confined to the message-body WebView (C:L/I:L, no A), enabling DOM reads, message-data exfiltration, and in-body phishing overlays rather than device or account takeover. Net: a legitimately patch-worthy issue, but a targeted phishing/data-leak vector, not a wormable or mass-exploitation threat.

An attacker sends a crafted AMP email containing an inline <script> or an element with an on* handler / javascript: URL that survives the incomplete sanitizer. When the recipient opens the message and taps the AMP toggle, the WebView executes the attacker's JavaScript, which reads the message DOM, exfiltrates message content, and renders a phishing overlay inside the message body. No public exploit code was identified at time of analysis, though the patch diff documents the bypassed sanitization logic.