CVE-2026-55850

The vulnerability in Element (CVE-2026-55850) stems from EmbeddedPage.tsx rendering homeserver-supplied homepage content via dangerouslySetInnerHTML without applying the available sanitizedHtmlNode utility. This is not a case of missing sanitization infrastructure—the function exists and works. It's a trust boundary failure: developers treated content from the user's connected homeserver as implicitly trusted, but Matrix's federated architecture means any homeserver your client connects to can supply this content. That includes compromised servers, malicious operators, or federated servers you never intended to trust. The real risk is not JavaScript execution—the CSP blocks that. The risk is credential harvesting. A malicious homeserver can serve a convincing 're-login to Matrix' prompt or fake support portal inside an authenticated session, and users have no reason to suspect a server they already trust. This is why the 5.3 CVSS score is misleading: it measures what the tooling can detect (blocked script execution), not what actually matters (phishing from an authenticated context). What to check in your deployment: verify that every code path rendering homeserver-supplied HTML applies sanitization, including room directory content, integration manager responses, and login flow elements. The existence of a sanitization utility doesn't guarantee coverage—audit your render paths, not just your dependencies. The pattern likely exists in other Matrix clients, so your threat model should assume federated content is untrusted by default until proven otherwise. Patching Element to 1.12.22 closes this specific vector, but the underlying architecture—servers you don't control serving content your client renders—will persist as long as federation exists.

Reviewed through automated stages and approved by a human before publication.