CVE-2026-55850: Element Web Matrix Client XSS Vulnerability

CVE-2026-55850 Overview

Element Web is a Matrix web client built with the Matrix React SDK. A cross-site scripting weakness [CWE-79] affects versions prior to 1.12.22. The EmbeddedPage component in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through React's dangerouslySetInnerHTML without routing the input through sanitizedHtmlNode. A malicious homeserver can serve crafted HTML that Element Web then renders on the client homepage. The Content Security Policy blocks JavaScript execution but does not prevent attacker-controlled phishing markup, links, or styled content from appearing inside the trusted application chrome. The issue is fixed in version 1.12.22.

Critical Impact
An attacker controlling a homeserver can inject arbitrary HTML into the Element Web homepage, enabling phishing content to render inside the trusted client interface.

Affected Products

Element Web versions prior to 1.12.22
EmbeddedPage component in apps/web/src/components/structures/EmbeddedPage.tsx
Deployments accepting homepage content from untrusted or third-party homeservers

Discovery Timeline

2026-08-21 - CVE-2026-55850 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-55850

Vulnerability Analysis

Element Web supports a configurable homepage that pulls HTML from a homeserver-defined URL. The EmbeddedPage React component fetched that response and passed the raw string directly into dangerouslySetInnerHTML. The application already exported a sanitizedHtmlNode helper that wraps sanitize-html with an allowlist of tags and attributes, but this helper was not applied to the embedded page path. As a result, the homepage rendering path trusted the homeserver more than the rest of the client, which sanitized message content through the same helper.

The application's Content Security Policy blocks inline and remote script execution, so classic script-based XSS payloads do not run. However, the CSP does not restrict HTML structure. An attacker can still inject styled elements, fake login prompts, spoofed notifications, deceptive hyperlinks, and images that impersonate Element UI. Because the content renders inside the trusted origin of Element Web, users have no visual indication that the markup came from an external source.

Root Cause

The root cause is inconsistent output encoding [CWE-79]. EmbeddedPage bypassed the shared sanitizer and wrote untrusted HTML directly to the DOM. The sanitizer function itself was sound; it was simply not invoked on the embedded page code path.

Attack Vector

Exploitation requires that a user's Element Web client connect to an attacker-controlled homeserver, or that a legitimate homeserver be compromised. The homeserver returns a crafted HTML document from its homepage endpoint. When the client loads or navigates to the home view, EmbeddedPage renders the payload. User interaction with rendered phishing content, such as clicking a spoofed login button, is required to achieve credential theft or redirection.

tsx

// Patch: apps/web/src/HtmlUtils.tsx
// Source: https://github.com/element-hq/element-web/commit/7949980a7e3c7e397d7afe899ef1b0563c417b0e
/*
 * Given an untrusted HTML string, return a React node with a sanitized version
 * of that HTML.
 * @param insaneHtml - the input to sanitize
 * @param className - an optional class name to apply to the element
 * @param sanitizeParams - the params to use for sanitization
 */
export function sanitizedHtmlNode(
    insaneHtml: string,
    className?: string,
    sanitizeParams = sanitizeHtmlParams,
): ReactNode {
    const saneHtml = sanitizeHtml(insaneHtml, sanitizeParams);
    return <div dangerouslySetInnerHTML={{ __html: saneHtml }} dir="auto" className={className} />;
}

tsx

// Patch: apps/web/src/components/structures/EmbeddedPage.tsx
// Source: https://github.com/element-hq/element-web/commit/7949980a7e3c7e397d7afe899ef1b0563c417b0e
import { sanitizedHtmlNode } from "../../HtmlUtils.tsx";
import { sanitizeHtmlParams, transformTags } from "../../Linkify.ts";
import { objectExcluding } from "../../utils/objects.ts";
// EmbeddedPage now renders homeserver-supplied HTML via sanitizedHtmlNode
// instead of writing it directly to dangerouslySetInnerHTML.

Detection Methods for CVE-2026-55850

Indicators of Compromise

Element Web build metadata reporting a version earlier than 1.12.22 in browser developer tools or /version endpoints.
Homeserver responses to the configured homepage URL containing unexpected <a>, <form>, <img>, or styled <div> elements referencing external domains.
User reports of unfamiliar login prompts, banners, or notifications rendered on the Element Web home view.

Detection Strategies

Inventory deployed Element Web instances and compare reported versions against 1.12.22.
Inspect network traffic between clients and homeservers for HTML responses on the homepage endpoint that include markup outside the expected allowlist.
Review browser telemetry for CSP violation reports that indicate blocked resources loaded from unexpected origins on the Element Web home route.

Monitoring Recommendations

Alert on outbound requests from Element Web sessions to domains not associated with the sanctioned homeserver.
Monitor authentication systems for credential submissions originating from Element Web sessions where the referrer is the home view.
Track user-reported phishing tickets that reference Element or Matrix branding to identify targeted campaigns leveraging this vector.

How to Mitigate CVE-2026-55850

Immediate Actions Required

Upgrade all Element Web deployments to version 1.12.22 or later, which applies sanitizedHtmlNode to the embedded homepage path.
Restrict users to trusted homeservers by configuring default_server_config and disabling arbitrary homeserver selection where feasible.
Communicate to users that homepage content is treated as external and should not be used to enter credentials or secrets.

Patch Information

The fix is delivered in Element Web release v1.12.22 via commit 7949980. See the GitHub Security Advisory GHSA-wrcp-5v3v-3j6v and the Machine Spirits advisory for background.

Workarounds

Configure Element Web to disable or override the embedded homepage using embeddedPages.homeUrl set to a controlled, static resource served by the operator.
Enforce a strict allowlist of homeserver domains via reverse proxy or network policy to prevent clients from connecting to attacker-controlled Matrix servers.
Tighten the Content Security Policy img-src, style-src, and form-action directives to limit the effectiveness of injected phishing markup until patching completes.

bash

# Example: override the Element Web homepage with a trusted local asset
# in the deployment's config.json
cat > /etc/element-web/config.json <<'EOF'
{
  "default_server_config": {
    "m.homeserver": { "base_url": "https://matrix.example.org" }
  },
  "embeddedPages": {
    "homeUrl": "https://static.example.org/element-home.html"
  }
}
EOF