New CSS Attacks Bypass Webmail Defenses, Enabling Password and Token Theft

CSS Vulnerabilities in Webmail Clients

New research has uncovered vulnerabilities in how webmail clients process and render email content, allowing malicious CSS to break out of its intended message boundary. This enables content within an email to interfere with the webmail interface itself, posing a risk to user security.

The techniques can be used to capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. This research highlights discrepancies between how CSS sanitizers interpret code and how browsers ultimately render it.

Affected Providers and Attack Chains

The research identified attack chains affecting major webmail providers, including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. Specific examples include an Outlook/Firefox chain that spoofs a Microsoft sign-in screen to capture passwords, and a Yahoo/AOL paste race that can expose a Medium email-login token.

Another chain, Gmail/Cowork, demonstrated the ability to exfiltrate a Slack token following prompt injection and user interaction. The research also noted that some webmail clients allow the browser to parse HTML and CSS first, then filter the interpreted output, which can still be mutated into something malicious.

Proof-of-Concept and Remediation Efforts

PortSwigger researcher Gareth Heyes presented this work at Black Hat USA 2026, providing proof-of-concept research. As of August 8, public PoCs remain available, though no malicious exploitation has been reported.

Some vulnerabilities have been addressed; Fastmail fixed two CSS mutation bugs, and a Proton Mail proxy bypass stopped working upon retesting. However, Outlook label-jacking and Gmail's image-set() bypass were still functional when the research was published on August 6.