PortSwigger has disclosed new cybersecurity research demonstrating how CSS based techniques can cross the boundary between email content and webmail interfaces, potentially exposing passwords, authentication tokens, trusted user interface actions, and AI connected workflows across several major email platforms. The research was presented by PortSwigger researcher Gareth Heyes at Black Hat USA 2026 and includes proof of concept demonstrations involving Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. According to the research, the techniques do not represent confirmed malicious activity in the wild, but instead illustrate how specific combinations of HTML, CSS, browser behavior, and application logic could be used to influence trusted webmail interfaces. Public proof of concept demonstrations remained available as of August 8, 2026. During testing, Fastmail addressed two CSS mutation issues and a previously identified Proton Mail proxy bypass was no longer reproducible, while Outlook label based manipulation and Gmail image set related behavior were still functioning when the research was published on August 6. The paper does not confirm whether the complete Outlook password capture sequence has since been addressed.
According to the research, two primary methods make these attack chains possible. One relies on HTML and CSS features that webmail platforms already permit, while the other exploits differences between what sanitization systems approve and what browsers or applications eventually generate. In the Outlook demonstration, permitted label elements were able to trigger controls outside the email itself, while application JavaScript transformed sanitized custom attributes into new document object model elements containing CSS that bypassed original restrictions. A media query parsing technique then enabled arbitrary CSS execution. The proof of concept disguised a select menu as a password field, allowing Firefox browser behavior to repeatedly reset its option selection timer whenever the element moved off screen, enabling real time password capture if a victim entered credentials into the spoofed Microsoft sign in interface. Separate demonstrations involving Yahoo Mail and AOL Mail focused on HTML pasted into draft messages. Researchers reported that pasted content could briefly retain active CSS before sanitization. In the demonstrated scenario, an attacker initiated a Medium email login process, convinced a victim to copy specially prepared CSS, and after the victim pasted the content into a Yahoo or AOL draft, enough of the authentication token became exposed through generated requests for the attacker to reconstruct the complete login token and access the victim account.
The research also examined scenarios where traditional browser protections limited outbound communication. In environments protected by Content Security Policy, the researchers demonstrated a click based data exposure technique in which injected CSS analyzed visible numeric tokens, selectively displayed matching links, and relied on user interaction to transmit portions of the information to an external server. Another demonstration focused on AI connected email environments. Researchers reported that Gmail image set behavior could generate an external request despite sanitization controls. They combined this with an indirect prompt injection email processed by Anthropic Claude Cowork through a Gmail connector. In the demonstration, after a Slack confirmation email arrived and the victim instructed Cowork to process incoming messages, injected instructions caused the AI assistant to retrieve the authentication token, insert it into an HTML draft, and expose it when the draft was viewed. A separate Fastmail demonstration targeted OpenAI Atlas AI browser by hiding malicious instructions from human readers while allowing the AI model to process them. The research showed how hidden prompts could cause the AI to open browser tabs and encode user information into URL fragments. OpenAI has announced that Atlas is being retired and is scheduled to stop operating on August 9, 2026.
Additional findings included Fastmail CSS hotwiring, which researchers said could redirect users toward unintended interface actions, and an escaped backslash Fastmail image proxy technique capable of revealing when an email had been opened. Gareth Heyes also documented a Proton Mail technique that exposed recipient IP addresses during testing, although Proton documentation states that its email tracker protection is designed to conceal personal IP addresses and exact email open times. PortSwigger has published a public repository containing proof of concept demonstrations for the disclosed techniques and recommends several defensive measures for webmail providers. These include isolating HTML email inside sandboxed iframes, applying strict CSS character allow lists, validating custom attributes before processing, restricting select menus and potentially dangerous CSS selectors, and preventing attacker controlled image requests or reliance on allow listed domains. The research emphasizes strengthening the separation between untrusted email content and trusted webmail interfaces while reducing opportunities for CSS based manipulation across modern email services.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
