CSS Attacks Breach Webmail Defenses to Steal Credentials
New research demonstrates how emails can escape boundaries to capture passwords and tokens.
1Techniques Bypassing Webmail Security
PortSwigger researcher Gareth Heyes revealed at Black Hat USA 2026 that email content can breach webmail interfaces. CSS manipulation techniques were developed to steal passwords, leak tokens, and hijack accounts on platforms like Outlook, Gmail, and Yahoo Mail. One Outlook exploit on Firefox spoofs Microsoft's login screen to capture credentials. The research recommends isolating HTML emails in sandboxed iframes as a primary defense measure against these boundary-crossing attacks.
2Chained Exploit in Outlook
Label elements in Outlook can trigger controls outside the message container. JavaScript converts sanitized custom attributes into DOM nodes carrying CSS outside the allow list. A media query parsing trick grants attackers arbitrary CSS application. Firefox's selection timer resets when the select element moves offscreen, enabling real-time password capture. This exploit chain capitalizes on discrepancies between sanitizer approval and browser rendering behaviors.
3Token Leakage in Yahoo/AOL
Pasted HTML in Firefox briefly retains active CSS before sanitization. In the Medium demonstration, attackers initiate an email-login flow, prompting victims to paste attacker-supplied CSS into drafts. The resulting requests leak portions of 12-character login tokens, enabling account reconstruction. Fastmail patched two CSS mutation bugs, but other vulnerabilities remain active as of August 2026. The research highlights how temporary execution windows can compromise entire authentication systems.
4Click-Based Data Exfiltration
When Content Security Policy blocks external resources, a click-based technique bypasses restrictions. For numeric tokens rendered as text, CSS identifies digit occurrences and frequencies. Non-matching links are hidden while the matching link remains visible. Victim clicks transmit digit patterns to attacker servers. This method demonstrates how client-side rendering details can be weaponized despite CSP protections, requiring stricter CSS validation measures.
5AI-Integrated Email Vulnerabilities
Gmail's image-set() fallback makes external requests despite sanitization. PortSwigger chained this to indirect prompt injection via Anthropic's Claude Cowork connected to Gmail. After triggering Slack token confirmation emails, victim requests to process emails caused the AI to retrieve tokens into HTML drafts. Viewing drafts completed the leakage. OpenAI's Atlas browser similarly interpreted hidden CSS prompts differently than human users, prompting its scheduled August 2026 deprecation.
6Fastmail UI Manipulations
Fastmail's 'CSS hotwiring' redirects clicks into unintended multi-step UI actions. Another technique uses allow-listed user.fm domains to expose email open times. Proton Mail had a vector exposing recipient IP addresses, contradicting its tracker-protection claims. These demonstrate how seemingly minor CSS allowances can enable significant privacy violations. OpenAI announced Atlas's discontinuation, acknowledging its vulnerability to such attacks.
7Defensive Recommendations
Researchers advocate strict isolation of HTML emails as the primary defense. Secondary measures include CSS character allow lists, pre-approval checks for CSS gadgets, blocking dangerous selectors and select menus, and preventing attacker-controlled image requests. The public repository contains PoCs for all disclosed techniques. Providers must reassess CSS sanitization approaches, as current implementations frequently mismatch browser interpretations.
8Industry and User Impacts
As of August 6, 2026, Outlook label hijacking and Gmail's image-set() bypass remained unpatched. The full Outlook password-capture chain's status is unknown. AI-powered email tools introduce novel risks for enterprise users. Providers face urgent patching requirements while users should exercise caution with CSS/HTML in suspicious emails. The research underscores how evolving web standards require continuous security reassessment.
Original article: The Hacker News — CSS Saldırıları Webmail Güvenliğini Tehdit Ediyor