CVE-2026-55850

Executive Summary

CVE-2026-55850 is a stored cross-site scripting (XSS) vulnerability in Element Web, a Matrix chat client built with the Matrix React SDK. Prior to version 1.12.22, the EmbeddedPage component renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode, allowing a malicious or compromised homeserver to inject arbitrary HTML into the homepage of every user connected to that server. While the Content Security Policy (CSP) prevents JavaScript execution, the injected HTML can be used for phishing attacks, credential harvesting, and social engineering against Element Web users. The vulnerability is fixed in version 1.12.22; however, as of this report, no patch evidence has been tracked by public sources, and the patch confidence rating is 0/4.

Technical Analysis

The vulnerability resides in the EmbeddedPage component located at apps/web/src/components/structures/EmbeddedPage.tsx in the Element Web codebase. The Matrix protocol allows homeservers to advertise a custom homepage URL that renders within the Element Web client. When a user authenticates or loads the client, Element Web fetches this homepage content from the homeserver configuration.

The root cause is the unsafe use of dangerouslySetInnerHTML — a React API that bypasses React's default escaping and directly sets HTML content into the DOM. The NVD description explicitly states that the homeserver-supplied homepage content is rendered through dangerouslySetInnerHTML without being passed through sanitizedHtmlNode, which is Element's internal sanitization utility (likely a wrapper around DOMPurify or a similar HTML sanitizer).

The attack surface is any user of Element Web connecting to a homeserver that returns malicious homepage HTML. The threat model is particularly relevant in two scenarios:

1. Federated Matrix ecosystems — a user connecting to a public or federated homeserver that they do not operate
2. Self-hosted deployments — an attacker who has achieved configuration-level compromise of the homeserver (e.g., via exposed admin APIs, leaked credentials, or a separate vulnerability in the homeserver software such as Synapse or Dendrite)

The dangerouslySetInnerHTML sink means that all HTML tags, attributes, and inline event handlers present in the homeserver-supplied content are interpreted by the browser. The NVD description notes that the Content Security Policy blocks JavaScript execution, which mitigates the most severe XSS impact — direct script execution in the user's session context. However, CSP does not block HTML content, including:

• Phishing forms that mimic login dialogs or password prompts
• Malicious <iframe> elements embedding attacker-controlled pages
• Social engineering bait with deceptive content
• Theft of user data entered into such forms
• Clickjacking-style UI redress attacks

The attack vector is network (AV:N) with the homeserver acting as the untrusted input source. The privilege required is low (PR:L) because an attacker generally needs the ability to modify homepage content on a homeserver they control or have compromised. User interaction is required (UI:R) because the victim must load the Element Web homepage or navigate to the default homepage view. The scope is changed (S:C) because the injected content executes within the Element Web application's origin but can influence user behavior beyond the vulnerable component. Confidentiality and integrity impacts are both low (C:L/I:L) because JavaScript is blocked by CSP, limiting the attacker to HTML-content phishing rather than direct data exfiltration or DOM manipulation. Availability is none (A:N).

Exploitation Scenarios

Step 1 — Reconnaissance / Target Identification

An attacker first identifies Matrix homeservers running Element Web that permit custom homepage configuration. This may involve:

• Scanning for exposed Matrix federation ports (typically 8448/tcp with TLS)
• Querying public Matrix server directories to identify homeservers that allow unauthenticated user registration
• Targeting homeservers with known secondary vulnerabilities that grant configuration access
• Identifying self-hosted Element Web instances where operators may have misconfigured the homepage feature

Step 2 — Triggering the Flaw

The attacker must supply malicious HTML as the homepage content. For a homeserver the attacker controls, this is simply a matter of setting the m.widgets or homepage configuration field (as defined by the Matrix specification) to include attacker-controlled HTML. For a compromised homeserver, the attacker modifies the homeserver database or configuration file that stores the homepage content. When any user opens Element Web and authenticates against this homeserver, the client fetches and renders the homepage HTML.

Step 3 — Payload / Execution Method (Vulnerability-Class Level)

Because this is a stored XSS via HTML injection (CWE-79), the payload is HTML rather than JavaScript. The injected content is rendered in the victim's browser through dangerouslySetInnerHTML. The attacker crafts HTML that performs phishing or social engineering without requiring script execution:

• An embedded login form styled identically to Element's own login UI, capturing credentials when the victim submits
• A fake "cross-signing verification required" page that prompts the victim to enter their recovery key or security phrase, which the attacker harvests — this is particularly effective because of the sensitive nature of Matrix cross-signing keys
• A deceptive "software update required" banner that directs the victim to an attacker-controlled download URL
• An <iframe> element embedding a malicious site that performs session token theft or browser-based attacks

Step 4 — Post-Exploitation Impact

Post-exploitation impact depends on the success of the phishing payload:

• Compromised Matrix account credentials allow the attacker to read private messages, exfiltrate chat history, impersonate the victim in rooms, and potentially access encrypted room content if the victim's cross-signing keys are recovered
• If the victim enters their recovery key or security phrase, the attacker can decrypt the victim's end-to-end encrypted messages, defeating the encryption guarantees of the Matrix protocol
• Compromised corporate accounts can be used to pivot into additional enterprise infrastructure where Matrix is used for internal communication

Note: No public PoC is available at the time of writing; the attack chain is inferred from the vulnerability class and the technical description provided in the NVD entry.

Impact Assessment

The business impact of CVE-2026-55850 is moderate-to-high depending on deployment context:

Affected Systems:

• All Element Web installations running version < 1.12.22
• Any user connecting to a malicious or compromised homeserver through an affected Element Web client
• User-accessible Matrix deployments where the homeserver operator is not fully trusted (federated, hosted, or community-operated servers)

Attack Vector and Scope: The attack requires either attacker-controlled homeserver hosting or homeserver compromise. The UI:R user interaction requirement means the impact is not automated exploitation but rather social-engineering-driven compromise. The S:C scope change means the injected HTML exists in the Element Web application's security context but can directly influence user actions beyond the vulnerable component.

Blast Radius:

• Credentials — phishing forms can capture Matrix account passwords
• End-to-End Encryption — if cross-signing recovery keys are phished, encrypted message history is exposed
• User Trust — the homepage is the first thing a user sees; phishing content on the homepage has high legitimacy perception
• Enterprise Deployments — organizations running internal Matrix servers may have the homepage managed by administrators; if those servers are compromised, all users are exposed

CVSS Assessment: The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N reflects a network-accessible flaw with low attack complexity but requiring low privilege (homeserver control), user interaction (victim accessing the homepage), and changed scope. The low confidentiality and integrity scores reflect the CSP restriction on JavaScript execution, which limits payload capability to HTML-based phishing rather than direct script-driven exfiltration.

Detection Guidance

Sigma Rule

title: Element Web EmbeddedPage HTML Injection Attempt
id: hmm...-needs-real-guid
status: experimental
description: Detects requests to Element Web endpoints that return homepage content containing suspicious HTML injection markers, indicative of CVE-2026-55850 exploitation.
author: vartersit.com Threat Intelligence
date: 2026/02/15
logsource:
  category: webserver
  product: nginx
  service: http
detection:
  selection:
    cs-uri-extension: 
      - '*.js'
      - '*.json'
    c-uri|contains:
      - 'homepage'
      - 'config'
  filter_main_legit:
    http_response_body|contains:
      - 'riot:autoload'
      - '<h1>Welcome'
  condition: selection and not filter_main_legit
level: medium
falsepositives:
  - Legitimate homeserver configuration returning valid homepage content
tags:
  - attack.t1190
  - cve.2026-55850

YARA Rule

rule Element_Web_Homepage_HTML_Injection
{
    meta:
        author = "vartersit.com Threat Intelligence"
        description = "Detects HTML content associated with CVE-2026-55850 phishing homepage injection"
        cve = "CVE-2026-55850"
        date = "2026-02-15"
        score = 60
    
    strings:
        $dangerous = "dangerouslySetInnerHTML" ascii wide nocase
        $embedded = "EmbeddedPage" ascii wide nocase
        $unsafe_html_config = "homepage" ascii wide nocase
        $form_phish = "<form" ascii wide nocase
        $iframe_phish = "<iframe" ascii wide nocase
        $login_prompt = "password" ascii wide nocase
    
    condition:
        (any of ($form_phish, $iframe_phish)) and
        ($login_prompt) and
        (any of ($dangerous, $embedded, $unsafe_html_config))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55850 - Element Web Homepage HTML Injection Attempt"; 
flow:established,to_server; 
content:"GET"; http_method;
content:"homepage"; http_uri; 
content:"config"; http_uri;
pcre:"/<(form|iframe|object|embed)/i";
pcre:"/(onclick|onload|onerror)/i";
reference:cve,2026-55850;
classtype:web-application-attack;
sid:10055850; rev:1;)

Elastic Detection

any where
  event.category == "authentication" or
  event.category == "web" and
  (
    process.command_line == "*EmbeddedPage*" or
    process.command_line == "*homepage*"
  ) and
  (
    file.content == "*dangerouslySetInnerHTML*" or
    network.protocol == "http" and
    network.http.response.body == "*<form*password*" or
    network.http.response.body == "*<iframe*src=*"
  )

Splunk SPL Query

index=web sourcetype=access_combined
| where like(_raw, "%GET /homepage%")
| eval http_status_code = status
| search status=200
| rex field=bytes ".*"
| table _time src_ip dest_ip uri status user_agent
| search uri="*homepage*" 
| append [search index=proxy sourcetype=stream:http
    | where like(_raw, "%<form%") OR like(_raw, "%<iframe%")
    | table _time src_ip dest_ip http_content_type
    | where http_content_type="text/html"]
| dedup _time src_ip
| stats count by src_ip dest_ip
| where count > 5

Wazuh OSSEC Rule

<group name="web_app_attack,">
  <rule id="553783" level="10">
    <if_sid>31122</if_sid>
    <match>GET /homepage</match>
    <regex>(?i)(<form|<iframe|onclick|onload|password)</regex>
    <description>CVE-2026-55850 - Element Web homepage contains potential phishing HTML</description>
    <group>cve_2026_55850,web_application_attack</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

The NVD description states the vulnerability is "fixed in version 1.12.22" of Element Web. However, the tracked patch confidence from aggregator sources is 0/4, with no patch evidence available from any tracked source. This discrepancy suggests that either (a) the fix has been released but not yet indexed by vulnerability databases, or (b) the fix is distributed through Element's proprietary update channel rather than a public, trackable release.

Immediate Mitigations (Temporary):

1. Upgrade to Element Web 1.12.22 or later — This is the primary remediation. Check Element's release notes at https://github.com/element-hq/element-web/releases for the specific release confirming the EmbeddedPage sanitization fix.
2. Monitor homeserver homepage configuration — Administrators should verify that their homeserver's homepage content is controlled and does not contain untrusted HTML. Review homeserver.yaml and any config endpoints that serve homepage HTML.
3. Add a Content-Security-Policy header — While the NVD description notes a CSP is already in place, verify that your Element Web deployment's CSP also blocks <object>, <embed>, <frame>, and restricts <form> actions to known origins. Consider adding frame-ancestors 'self' and form-action 'self'.
4. Validate homeserver trust — For users connecting to potentially untrusted homeservers, instruct them not to enter credentials into the homepage view if it appears unusual, and verify the URL is https://app.element.io or the organization's sanctioned instance.
5. Restrict inbound federation — If the organization operates its own Matrix homeserver, restrict which remote homeservers are allowed to federate, reducing the chance of a malicious remote server supplying crafted homepage content.

Patch/Upgrade Steps:

1. Identify all Element Web deployments within the organization (self-hosted web clients, embedded clients, and mobile wrappers).
2. Upgrade all deployments to version 1.12.22 or later using the official distribution channel:
   • Self-hosted: replace the web bundle with the fixed release artifact
   • Docker: pull the updated container image tag
3. After upgrade, verify the EmbeddedPage component now routes content through sanitizedHtmlNode by inspecting the bundled JavaScript for the removal of the unsafe dangerouslySetInnerHTML call directly on homeserver-supplied content.

Long-Term Hardening:

1. Defense in Depth for HTML Sanitization — Organizations should ensure any component that renders external content implements sanitization (e.g., DOMPurify) regardless of CSP presence. CSP should be considered a mitigating control, not a primary defense, for XSS.
2. Homeserver Configuration Hardening — Restrict the ability to modify homepage/theme/branding configuration to administrative accounts only, and audit those endpoints for unauthorized changes.
3. Regular Vulnerability Scanning — Add Element Web to the organization's patching schedule and vulnerability scanning pipeline. Monitor Element's security advisories via the Element Security Disclosure Policy.
4. User Security Awareness — Train users of Matrix clients to recognize phishing HTML within the client, particularly on the homepage view, and understand that the presence of the Element UI chrome does not guarantee content authenticity.
5. Federation Security — Include Matrix federation endpoints in network monitoring and consider implementing allow-lists for federated servers in high-security deployments.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-55850
2. Element Web GitHub Repository — https://github.com/element-hq/element-web (for release notes confirming fix in version 1.12.22)
3. Element Security Disclosure — https://element.io/security (Element Security Policy and advisory publication)
4. Matrix Specification — Client-Server API — https://spec.matrix.org/latest/client-server-api/ (for understanding homeserver homepage content delivery mechanism)
5. CWE-79 — Improper Neutralization of Input During Web Page Generation — https://cwe.mitre.org/data/definitions/79.html

Threat Actor / Exploit-in-the-Wild Status: No known threat actor campaigns or actual exploitation in the wild have been reported as of the writing of this report. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.