Webmail CSS Attacks Allow Password Theft, UI Hijacking, and AI Exploitation

Sandboxing untrusted user input remains one of the most complex challenges in web application security, particularly within webmail clients. While security engineering teams have largely mastered blocking inline JavaScript (<script> tags and inline event handlers like onload or onerror), the presentation layer remains surprisingly vulnerable. Research presented by PortSwigger researcher Gareth Heyes at Black Hat USA 2026 demonstrates that webmail CSS attacks can break out of message boundaries across nearly every major webmail provider, enabling credentials theft, session hijacking, UI manipulation, and indirect prompt injection against AI email assistants.

The findings highlight vulnerabilities in Microsoft Outlook, Google Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. Rather than relying on traditional cross-site scripting (XSS) or executable code, these attack chains exploit structural flaws in HTML sanitizers, parser differentials between sanitizers and browser engines, and the intrinsic power of cascading style sheets.

Crossing the Webmail Boundary via CSS

Webmail providers rely on complex HTML sanitizers to clean incoming messages before rendering them in the user’s browser. The threat model assumes that while the message content is untrusted, the surrounding webmail interface (the navigation bars, action buttons, and account settings) is trusted. However, CSS is not merely declarative layout instructions—it is a functional language capable of state evaluation, layout redressing, DOM traversal, and out-of-band data exfiltration.

The research splits these boundary-crossing techniques into two categories:

1. Sanitizer Abuse: Exploiting HTML elements and CSS properties that sanitizers explicitly permit, but combining them in ways that affect elements outside the intended message container.
2. Parser Discrepancies: Generating a misalignment between what the HTML sanitizer approves and what the browser engine or client-side JavaScript ultimately constructs in the Document Object Model (DOM).

When an attacker successfully injects arbitrary CSS or breaks out of the message wrapper, they can override styles across the host application, manipulate user interface elements, monitor DOM state changes, and issue unauthorized network requests.

Exploit Chains Across Top Webmail Platforms

The research demonstrated full, end-to-end exploit chains targeting specific platform quirks across six major email services:

• Microsoft Outlook Sign-In Phishing: By abusing permitted <label> elements within an email body, an attacker can target form controls situated outside the message frame. In Outlook, client-side JavaScript transformed sanitized custom attributes into active DOM nodes carrying CSS properties that bypassed the sanitizer allow-list. By combining this with a media-query parsing trick, the attacker gained arbitrary CSS injection. The chain rendered a fake sign-in field disguised as a <select> dropdown over the interface. Under Firefox, moving a <select> element offscreen continuously resets its selection timer, allowing the attacker to record typed passwords in real time.
• Yahoo Mail & AOL Mail “Paste Race” Exfiltration: Under Firefox, when a user pastes HTML into a draft email, the browser briefly retains active CSS styles before the application’s sanitizer processes the input. In a practical attack against Medium’s passwordless login flow, an attacker triggers a login email to the victim, tricks the victim into copying attacker-supplied markup, and pastes it into a Yahoo or AOL draft. The transient CSS execution fires requests back to an attacker-controlled server, revealing enough of Medium’s 12-character email login token to reconstruct the secret and hijack the victim’s account.
• Fastmail & Proton Mail UI Hijacking: Fastmail was susceptible to “CSS hotwiring,” where injected styles alter element click targets to redirect user interactions into unintended, multi-step administrative UI actions. Fastmail also contained an escaped-backslash image-proxy bypass on the user.fm domain that allowed senders to detect when an email was opened. Separately, Proton Mail contained a vector that bypassed its tracker protection and IP proxying, exposing the victim’s real IP address upon opening a message.
• CSP Bypass via Click-Based Exfiltration: On systems protected by strict Content Security Policies (CSPs) that block external images or styles, CSS can still exfiltrate sensitive alphanumeric tokens displayed in an email. Using CSS selectors to evaluate text patterns, the injected stylesheet dynamically hides all links in the email except the one corresponding to the identified characters. When the user clicks anywhere on the remaining visible link, the victim manually transmits the token structure to the attacker’s infrastructure.

Hijacking Connected AI Assistants

As webmail providers integrate large language models (LLMs) to read, summarize, and draft messages, CSS boundaries become critical defense points against indirect prompt injection.

In a Gmail attack chain developed by Gareth Heyes and Pete Hendy, the researchers bypassed Gmail’s image proxy using an image-set() fallback behavior. They chained this layout bypass to Anthropic’s Claude Cowork via its connected Gmail integration. In the demonstrated scenario, the attacker triggered a Slack confirmation email to the victim and sent a separate indirect prompt injection email. When the victim instructed Cowork to process their inbox, the injected instructions forced the AI model to retrieve the Slack confirmation token and place it inside an HTML draft email. Opening the generated draft executed the image-set() request, exfiltrating the Slack token to the attacker.

A related attack targeted OpenAI’s Atlas AI browser within Fastmail. By employing CSS pseudo-elements and opacity adjustments, the email displayed benign text to human eyes while presenting hidden prompt injection instructions to the AI model. When the user asked Atlas to translate the visible message, the model executed the hidden instructions, opening external browser tabs and encoding the victim’s profile name in URL fragment parameters. OpenAI has since deprecated the Atlas browser, with service decommission scheduled for August 9, 2026.

Engineering Sandboxed Webmail Defenses

Mitigating CSS boundary leaks requires webmail architectures to treat CSS with the same isolation guarantees applied to untrusted JavaScript. Vendors have begun patching specific findings—Fastmail resolved its CSS mutation flaws, Proton Mail updated its proxy controls, and several image proxy bypasses have been closed—but comprehensive protection requires systemic structural changes:

1. Strict Iframe Sandboxing: HTML email bodies must be rendered within isolated <iframe> elements hosted on separate, unauthenticated subdomains. The iframe must omit allow-same-origin to prevent the inner document from traversing or styling the parent window DOM.
2. Strict CSS Whitelisting: Sanitizers should enforce strict character allow-lists for CSS rules, explicitly banning complex selectors (such as :has(), :focus-within(), or custom pseudo-classes) and restricting absolute positioning or z-index manipulation that enables UI overlay attacks.
3. Custom Attribute Sanitization: Applications must audit client-side JavaScript frameworks to ensure that custom data-* or non-standard HTML attributes cannot be re-parsed or transformed into un-sanitised DOM elements after the initial sanitization pass.
4. Proxy All Assets: All external resource requests—including images, fonts, media queries, and image-set() fallbacks—must be unconditionally routed through an isolated image proxy that strips user identifiers, prevents timing side-channels, and blocks internal domain allow-lists.