Executive brief
FairEmail is an open-source privacy-focused email application for Android. A vulnerability in the AMP message renderer allows attackers to execute arbitrary JavaScript within email messages when users enable AMP rendering. An attacker can exploit this to steal message data, read sensitive information from the email, or display fake login screens (phishing overlays) to trick users into revealing credentials.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the ActivityAMP.java WebView renderer that handles AMP (Accelerated Mobile Pages) emails. The component uses JavaScript-enabled WebView but only partially sanitizes untrusted HTML: it removes the "src" attribute from script tags for non-allowlisted hosts, but leaves inline script elements intact and fails to filter event-handler attributes (like onclick, onload) or javascript: URLs on other HTML elements. An attacker can craft a malicious AMP email that executes arbitrary JavaScript code when the recipient opens the message and explicitly enables the AMP toggle. The attack requires user interaction (enabling AMP rendering) and is limited by AMP email rarity in practice. The vulnerability is patched in version 1.2319.
Affected products
- FairEmail FairEmail before 1.2319
Timeline
- 2026-09-17: disclosed
- 2026-06-06: patched: Version 1.2319 released