Fairemail
Monthly
Cross-site scripting in the FairEmail Android email app (versions prior to 1.2319) allows a crafted AMP email to execute arbitrary JavaScript inside the message-body WebView once the recipient manually enables the per-message AMP toggle, enabling the attacker to read the message DOM, exfiltrate message data, and draw phishing overlays within the message body. The vulnerable ActivityAMP renderer fails to strip inline script bodies, on* event-handler attributes, and javascript: URLs on non-allowlisted hosts, and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N confirms unauthenticated remote delivery with required user interaction, scope change, and limited confidentiality/integrity impact but no availability impact. No public exploit code or active exploitation is identified at time of analysis, and practical risk is further lowered because AMP email is uncommon and AMP rendering is off by default.
Cross-site scripting in the FairEmail Android email app (versions prior to 1.2319) allows a crafted AMP email to execute arbitrary JavaScript inside the message-body WebView once the recipient manually enables the per-message AMP toggle, enabling the attacker to read the message DOM, exfiltrate message data, and draw phishing overlays within the message body. The vulnerable ActivityAMP renderer fails to strip inline script bodies, on* event-handler attributes, and javascript: URLs on non-allowlisted hosts, and the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N confirms unauthenticated remote delivery with required user interaction, scope change, and limited confidentiality/integrity impact but no availability impact. No public exploit code or active exploitation is identified at time of analysis, and practical risk is further lowered because AMP email is uncommon and AMP rendering is off by default.