Approved changes feed: RSS · Atom
cpe:2.3:a:m66b:fairemail:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | M66B (accb392d-9cc7-5eeb-9a16-0318ec673374) |
|---|---|
| Product | Fairemail (4ad559ee-9ff0-5c43-a465-455a4f82c232) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54521 |
vulnerable | 2026-10-13 12:29:13.664528 |
FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)
MEDIUM (6.1)
FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2319, the ActivityAMP AMP message renderer in app/src/main/java/eu/faircode/email/ActivityAMP.java enables JavaScript in its WebView but incompletely sanitizes untrusted message HTML. For non-allowlisted hosts, script.removeAttr("src") leaves inline script elements in the document and does not reject event-handler attributes or javascript: URLs on other elements. A crafted AMP email can execute arbitrary JavaScript when a recipient opens the message and enables the AMP toggle. The script can read the message DOM, exfiltrate message data, and display phishing overlays within the message-body area. Exploitation requires the recipient to enable the AMP toggle, and practical exposure is reduced because AMP email is uncommon. This issue is fixed in version 1.2319.
Published: 2026-09-17T20:17:47.341Z
Updated: 2026-09-18T20:08:14.389Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.