Attackers Can Abuse CSS Weaknesses to Steal Authentication Data From Webmail Services

New security research has revealed a series of sophisticated attack techniques that allow malicious content embedded within emails to break out of traditional message boundaries and interact with the trusted interfaces of popular webmail services.

According to findings presented by PortSwigger researcher Gareth Heyes at Black Hat USA 2026, these attacks demonstrate how carefully crafted HTML and CSS can be abused to manipulate webmail clients, potentially enabling attackers to steal credentials, hijack authenticated sessions, capture access tokens, abuse user interface elements, and even manipulate AI-powered email assistants.

The research examined attack chains affecting several major webmail platforms, including:

• Microsoft Outlook Web Access
• Gmail
• Fastmail
• Proton Mail
• Yahoo Mail
• AOL Mail

Email Content Escaping Its Intended Boundaries

Traditionally, webmail providers attempt to isolate email content from the rest of their application interface by sanitizing HTML and restricting potentially dangerous code.

However, the research demonstrates that under certain conditions, content contained within an email can interfere with the trusted portions of the webmail application itself.

The attacks generally fall into two categories:

1. Abuse of HTML and CSS features that webmail providers intentionally allow.
2. Exploitation of differences between what email sanitization engines approve and what browsers ultimately render or execute.

In both scenarios, attackers can blur the boundary between untrusted email content and privileged application functionality.

Outlook Attack Chain Can Capture User Passwords

One of the most notable demonstrations targeted Microsoft Outlook running in Firefox.

Researchers showed how a combination of permitted HTML elements, browser behaviors, and application logic could be chained together to present a convincing Microsoft sign-in form inside the email environment.

The technique exploits the interaction between:

• Label elements
• Custom attributes
• Dynamic DOM manipulations
• CSS injection techniques

Using these mechanisms, an attacker can disguise interface components as legitimate password fields and capture credentials entered by unsuspecting users.

The attack leverages browser-specific behavior in Firefox that allows a manipulated form element to continually remain active, effectively enabling real-time password collection.

Yahoo and AOL Vulnerabilities Expose One-Time Login Tokens

Researchers identified a separate attack path affecting Yahoo Mail and AOL Mail.

In this scenario, HTML pasted into a draft message could temporarily retain active CSS styling before sanitization processes removed it.

The proof-of-concept demonstrated an attack against Medium's email-based authentication mechanism.

The attack sequence involves:

1. The attacker initiating a Medium login request.
2. The victim copying attacker-supplied CSS content.
3. The victim pasting that content into a Yahoo or AOL email draft.

Under vulnerable conditions, the CSS briefly executes and leaks portions of the authentication token generated by Medium.

The fragmented token data can then be reconstructed on the attacker's server, enabling unauthorized access to the victim's account.

New CSS-Based Data Exfiltration Methods

The research also introduces a novel technique for stealing data even in environments protected by Content Security Policy (CSP) restrictions.

Instead of relying on direct external requests, the attack leverages CSS to analyze visible text and selectively expose information through controlled user interactions.

Using carefully crafted stylesheets, attackers can:

• Identify specific characters
• Determine digit frequency
• Hide legitimate interface elements
• Present attacker-controlled links

When a victim clicks one of these manipulated elements, encoded information is transmitted back to the attacker.

This approach demonstrates that even heavily restricted environments may still unintentionally leak sensitive information via seemingly harmless interactions.

AI-Enabled Email Systems Introduce New Risks

The research further highlights security concerns surrounding AI assistants that integrate with email platforms.

One demonstrated attack chain combined Gmail with Anthropic's Claude Cowork assistant.

Researchers found that Gmail's handling of the CSS image-set() function could trigger external requests despite sanitization efforts.

By combining this behavior with an indirect prompt-injection attack, the researchers showed how a malicious email could influence an AI assistant's actions.

In the demonstrated scenario:

• An attacker triggered a Slack authentication email.
• The victim asked the AI assistant to process incoming messages.
• Hidden instructions embedded in the email manipulated the AI into retrieving the Slack token.
• The token was inserted into an HTML draft.
• Viewing the draft caused the token to be exposed externally.

This attack illustrates how AI-powered workflows can unintentionally expand the attack surface of traditional email systems.

Fastmail Research Shows Human and AI Perceive Different Content

Researchers also demonstrated attacks against Fastmail involving OpenAI's Atlas AI browser.

Using CSS pseudo-elements and visibility manipulation techniques, researchers were able to show different content to human users and AI systems simultaneously.

While users saw benign text, the AI assistant interpreted hidden instructions embedded within the email.

When asked to process or translate the message, the hidden instructions caused the AI to perform additional actions and expose user-related information through manipulated URLs.

Additional Findings

Other techniques documented in the research include:

• CSS Hotwiring in Fastmail, allowing clicks to be redirected into unintended application actions.
• Image proxy bypasses that reveal when recipients open emails.
• Proton Mail tracking protections bypasses capable of exposing recipient IP addresses.
• UI manipulation attacks that leverage trusted interface components to perform unintended actions.

Current Mitigation Status

At the time of publication:

• Fastmail had reportedly fixed two CSS mutation vulnerabilities.
• A previously identified Proton Mail proxy bypass was no longer functioning.
• Gmail's image-set() behavior remained exploitable.
• Outlook label-jacking techniques were still reportedly effective.

Researchers noted that some proof-of-concept demonstrations remain publicly available, although the study did not identify any known malicious exploitation campaigns leveraging these techniques.

Recommendations for Providers

The research recommends several defensive measures for webmail providers, including:

• Rendering HTML emails inside strictly sandboxed iframes.
• Aggressively restricting CSS capabilities.
• Limiting custom attributes and form controls.
• Blocking dangerous selectors and interactive elements.
• Preventing attacker-controlled image requests.
• Verifying that sanitization logic matches actual browser behavior.
• Enhancing protections around AI-driven email processing.

Conclusion

The findings demonstrate that modern email security challenges extend far beyond traditional phishing and malicious attachments. By exploiting subtle interactions between HTML, CSS, browsers, webmail interfaces, and connected AI systems, attackers may be able to blur the separation between untrusted email content and trusted application functionality.

As webmail platforms increasingly integrate advanced features and AI-powered workflows, researchers warn that maintaining strict isolation boundaries between user content and application interfaces will become more important than ever.