CSS webmail research exposes routes to password and token theft

PortSwigger researcher Gareth Heyes has presented research showing how content inside an email can escape its intended boundary and interfere with webmail interfaces. The proof-of-concept chains span Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail and AOL Mail, with demonstrated outcomes including password capture, third-party account takeover, token leakage and manipulation of AI tools connected to email.

Presented at Black Hat USA 2026, the work examines two broad routes: abusing HTML and CSS that a webmail service permits, and exploiting a mismatch between a sanitizer’s approval and the DOM ultimately created by the browser or application. PortSwigger reported no malicious exploitation, but public proofs of concept remained available on August 8.

Outlook, Yahoo and AOL attack paths

In one Outlook and Firefox chain, allowed label elements could activate controls outside the email. Application JavaScript could also convert sanitized custom attributes into new DOM nodes carrying CSS that was not on the sanitizer allow list. A media-query parsing technique then enabled arbitrary CSS, while a disguised select element was used as a password field. Firefox resets its roughly one-second option-selection timer when that select is moved off-screen, enabling real-time capture of a password entered by the recipient.

Yahoo Mail and AOL Mail were exposed through a different Firefox behaviour: pasted HTML could briefly retain active CSS before sanitization. In a Medium email-login demonstration, a victim copied attacker-provided CSS and pasted it into a Yahoo or AOL draft. Requests generated by the result disclosed enough of Medium’s 12-character login token for an attacker server to reconstruct it and sign in as the victim.

AI-connected inboxes add another route

Heyes and PortSwigger colleague Pete Hendy also chained Gmail’s image-set() fallback to an indirect prompt-injection email processed by Anthropic Claude Cowork through a connected Gmail connector. After a Slack token confirmation email was triggered, the victim asked Cowork to process messages; injected instructions placed the token in an HTML draft, and viewing that draft leaked it through an external request.

A Fastmail demonstration involving OpenAI Atlas used CSS pseudo-elements and opacity to show a person benign text while an AI model received hidden instructions. When asked to translate the visible text, Atlas opened tabs and encoded the victim’s name in URL fragments. OpenAI is deprecating Atlas and says it is scheduled to stop working on August 9, 2026.

Defensive priorities for webmail teams

Fastmail fixed two CSS mutation bugs, and a Proton Mail proxy bypass no longer worked when retested. However, Outlook label-jacking and Gmail’s image-set() bypass still worked when the research was published on August 6. The paper does not say whether the complete Outlook password-capture chain was fixed.

The recommended response is strict isolation of HTML email in sandboxed iframes, followed by character allow lists for CSS validation, gadget checks before custom attributes are permitted, and restrictions on select menus, dangerous selectors and attacker-controlled image requests. The pattern aligns with borrowed trust in cybersecurity because trusted interface behaviour can be repurposed when untrusted content reaches it. For businesses, webmail sanitization, rendering and AI connector workflows should be tested together rather than treated as separate controls.