FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr("src") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. The script can read the message DOM, exfiltrate message data, and display phishing overlays within the message-body area. Exploitation requires the recipient to enable the AMP toggle, and practical exposure is reduced because AMP email is uncommon. This issue is fixed in version 1.2319.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-79"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54521.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54521.json"
[
{
"deprecated": false,
"digest": {
"function_hash": "49986603725516856166926224356465410609",
"length": 1092
},
"id": "CVE-2026-54521-07d20db4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/m66b/fairemail/commit/0b0fe9ac1cee98620f16aef85cebf67869ca41a8",
"target": {
"file": "app/src/main/java/eu/faircode/email/FragmentMessages.java",
"function": "updateNavPrevNext"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"233125047748168961662072070114157312796",
"215896600617493091483540445199337084126",
"150685685147236900437167454917875118018",
"153094280644162798307276523601795386186",
"223615574048743927875014306864918856070",
"94705904282135130591663326046609325055",
"228849373911754121483798388313435041939",
"220622316609268262042734370760954644633",
"58205530994584964713898716764075789214",
"272282095826039119692369346903974146355",
"243461941336170369029703337536534491300",
"130877740081808530771692305559228692659",
"75742138593001746147963850515457744947",
"323900720380039083905770337256019681432",
"292180494829212253603828895374598606299",
"34601005554600463948670491103761828010",
"99830422572200874336489617190101737753"
],
"threshold": 0.9
},
"id": "CVE-2026-54521-2bf0f092",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/m66b/fairemail/commit/fb37bbfabf5e75d08f0cfa6ce9b84469d62a20a0",
"target": {
"file": "app/src/main/java/eu/faircode/email/ActivityAMP.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "328403118434312059279786920236896276657",
"length": 1240
},
"id": "CVE-2026-54521-3f643e55",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/m66b/fairemail/commit/fb37bbfabf5e75d08f0cfa6ce9b84469d62a20a0",
"target": {
"file": "app/src/main/java/eu/faircode/email/ActivityAMP.java",
"function": "onExecute"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"316069995217111196998749881988736190941",
"211076817397541411754851732830308218559",
"123376569144643303683972441977546248609",
"269100249830499948444641492803827026516",
"133405514230426392663121694190398443592",
"193957835179776501218303287371701278393",
"125124821476822703294054589639447769465",
"53897343525744939952186367795510198300",
"334165025750305300349267458316833088357",
"52836315582566865848489656771409460975"
],
"threshold": 0.9
},
"id": "CVE-2026-54521-46380998",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/m66b/fairemail/commit/0b0fe9ac1cee98620f16aef85cebf67869ca41a8",
"target": {
"file": "app/src/main/java/eu/faircode/email/FragmentMessages.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "334896170007577611564539391839601007559",
"length": 2469
},
"id": "CVE-2026-54521-4efebbe2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/m66b/fairemail/commit/fb37bbfabf5e75d08f0cfa6ce9b84469d62a20a0",
"target": {
"file": "app/src/main/java/eu/faircode/email/ActivityAMP.java",
"function": "load"
}
}
]
"2026-09-20T14:24:14Z"