Executive brief
Element Web is a web-based chat client for the Matrix protocol that allows users to connect to Matrix homeservers. A malicious homeserver operator could craft phishing HTML content that Element Web would render on the homepage without proper sanitization, allowing credential theft or social engineering attacks against users of that homeserver.
Technical details
The vulnerability is a cross-site scripting (XSS) issue in the EmbeddedPage component (apps/web/src/components/structures/EmbeddedPage.tsx). The component renders homeserver-supplied homepage content using dangerouslySetInnerHTML without passing it through the sanitizedHtmlNode function, leaving the HTML unsanitized. Although Content Security Policy prevents JavaScript execution, a malicious homeserver can supply crafted HTML for phishing attacks. The vulnerability requires a compromised or malicious homeserver; a network-adjacent attacker with control over the homeserver can exploit this. The fix, released in version 1.12.22, applies HTML sanitization to the embedded page content.
Affected products
- Element Element Web before 1.12.22
Timeline
- 2026-08-21: disclosed
- 2026-06-15: patched: Fix committed on 2026-06-15; released in v1.12.22 on 2026-06-23