FairEmail versions prior to 1.2319 contain a CWE-79 cross-site scripting vulnerability in the ActivityAMP AMP message renderer. The renderer enables JavaScript in its WebView but incompletely sanitizes untrusted AMP email HTML. Specifically, for non-allowlisted hosts, the sanitization removes the 'src' attribute from script elements but leaves inline scripts intact and does not reject event-handler attributes or 'javascript:' URLs on other elements. This allows an attacker to craft an AMP email that executes arbitrary JavaScript when the recipient opens the message and enables the AMP toggle. The malicious script can access the message DOM, exfiltrate data, and display phishing overlays. The vulnerability is fixed in version 1.2319.

Successful exploitation allows arbitrary JavaScript execution within the AMP message renderer WebView, enabling attackers to read email message content, exfiltrate sensitive data, and display phishing overlays. This compromises confidentiality and integrity of email content. However, exploitation requires the recipient to enable the AMP toggle, and AMP emails are uncommon, reducing practical exposure.

Upgrade FairEmail to version 1.2319 or later, where this vulnerability is fixed. Users should avoid enabling the AMP toggle on untrusted emails until patched. No other vendor advisories indicate additional mitigations or that no action is required.