# CVE-2026-55850: Element Web cross-site scripting in embedded page

Source: https://junglewise.ai/threats/cve-2026-55850-element-web-cross-site-scripting-in-embedded-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55850 · Severity: info · CVSS 0 · Published 2026-08-21

Element Web is a web-based chat client for the Matrix protocol that allows users to connect to Matrix homeservers. A malicious homeserver operator could craft phishing HTML content that Element Web would render on the homepage without proper sanitization, allowing credential theft or social engineering attacks against users of that homeserver.

Technologies: [Element Web](https://junglewise.ai/threats/technologies/element-web). Vendors: [Element](https://junglewise.ai/threats/vendors/element).

## Quick answers

**Is CVE-2026-55850 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55850 being exploited in the wild.

**How severe is CVE-2026-55850?** Informational severity, with a CVSS score of 0, published 21 August 2026.

**Which products and versions are affected?** Element Web before 1.12.22.

**Is there a fix for CVE-2026-55850?** A patch was published on 2026-06-15: Fix committed on 2026-06-15; released in v1.12.22 on 2026-06-23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55850 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55850?** Check whether you run Element Web at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cross-site scripting (XSS) issue in the EmbeddedPage component (apps/web/src/components/structures/EmbeddedPage.tsx). The component renders homeserver-supplied homepage content using dangerouslySetInnerHTML without passing it through the sanitizedHtmlNode function, leaving the HTML unsanitized. Although Content Security Policy prevents JavaScript execution, a malicious homeserver can supply crafted HTML for phishing attacks. The vulnerability requires a compromised or malicious homeserver; a network-adjacent attacker with control over the homeserver can exploit this. The fix, released in version 1.12.22, applies HTML sanitization to the embedded page content.

## Affected products

- Element Element Web before 1.12.22

## Timeline

- 2026-08-21: disclosed
- 2026-06-15: patched: Fix committed on 2026-06-15; released in v1.12.22 on 2026-06-23

## References

- [https://github.com/element-hq/element-web/commit/7949980a7e3c7e397d7afe899ef1b0563c417b0e](https://github.com/element-hq/element-web/commit/7949980a7e3c7e397d7afe899ef1b0563c417b0e)
- [https://github.com/element-hq/element-web/releases/tag/v1.12.22](https://github.com/element-hq/element-web/releases/tag/v1.12.22)

## Related threats

- [Element Web and Element Desktop URL fragment credential injection](https://junglewise.ai/threats/cve-2026-119407-element-web-and-element-desktop-before-1-12-32-accept-guest)
- [Matrix matrix-js-sdk E2EE room key disclosure to homeservers](https://junglewise.ai/threats/cve-2021-40823-matrix-matrix-js-sdk-e2ee-room-key-disclosure-to-homeservers)