Threats affecting pkg:github/m66b/FairEmail

CVE-2026-54521 is a cross-site scripting (XSS) vulnerability in the FairEmail Android app's AMP message renderer prior to version 1.2319. The vulnerability arises because the app enables JavaScript in its WebView but does not fully sanitize untrusted AMP email HTML content. This allows crafted AMP emails to execute arbitrary JavaScript if the recipient enables the AMP toggle. Exploitation can lead to reading the message DOM, exfiltrating message data, and displaying phishing overlays within the message body. The issue is fixed in FairEmail version 1.2319.