CSS attacks on emails can go beyond the confines of an email and affect the webmail environment. New research from PortSwigger shows that malicious HTML and CSS are enough to steal passwords, tokens, and user actions.
Researchers Gareth Heyes and Pete Hendy tested Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. The Hacker News report clarifies that this is a test demonstration and not a confirmed exploit in real attacks.
See also: Updoc data breach exposes patient contact information
How CSS attacks work in webmail
Modern webmails attempt to sanitize the HTML of incoming messages, allowing only a limited set of CSS elements and properties. , PortSwigger shows that differences in parsers, weaknesses in filters, and elements of the application itself can create paths outside the email boundary.
In Outlook, a label could be linked to context features and affect the toolbar ribbon. Combined with a technique that converts permitted properties into new content, an attacker could present a fake Microsoft login context within a message and capture the password the recipient types.
Other CSS attacks exploit menu options, dummy elements, and image requests. The recipient can be tricked into clicking on one element without realizing that the action activates a different element in the context. This can reveal numeric tokens, the IP address, or even whether a message was opened.
The threat does not necessarily require JavaScript execution or malware installation. It is based on the connection between the message content, the way webmail transforms HTML, and the actions allowed on the same page. That is why controls must cover the entire chain.
See also: CoreBreak: AWS, Google and Vercel patched critical AI agent vulnerabilities
Theft of tokens and accounts
In Yahoo Mail and AOL Mail, the researchers demonstrated a scenario where pasting content into a draft email could gradually reveal a twelve-character login token. Requests to the attacker's server provided enough information to reconstruct the password for a service that uses email login.
Gmail had a different problem. The image-set() could cause an external request despite sanitization, creating a path for indirect command injection into tools that read emails. In the demonstration, Claude Cowork was able to retrieve a Slack token and place it in a scraped HTML, which then exposed the information.
The finding is particularly important for companies that connect AI assistants to email. A message doesn't have to contain JavaScript to function as an indirect prompt injection. It just needs to manipulate what the model sees or processes and lead it to take actions that the user didn't request.
Fastmail, Atlas and protection against CSS attacks
The research also tested Fastmail in conjunction with OpenAI’s Atlas AI browser. Hidden instructions could appear as innocent text to a human, while the model read different content and opened tabs with the victim’s details. OpenAI had announced that Atlas would stop working on August 9, 2026, but the scenario shows the danger of any assistant reading untrusted email.
Fastmail also found CSS context manipulation techniques that could turn a click into an action the user did not expect. The researchers report that Fastmail fixed two CSS mutation issues, while an older script in Proton Mail no longer worked upon retesting.
PortSwigger recommends isolating emails in iframes with limited permissions, a strict whitelist, and completely blocking dangerous selectors such as :has , :checked , :focus , and : not . Services should limit image requests, disallow menu options, and check for CSS mechanisms generated by the application code.
See also: NanoClaw file leak via serious vulnerability
The SecNews technical team recommends that organizations treat HTML emails as untrusted content, even when they appear within a known service. Administrators should review quarantine policies, restrict AI assistant connections to sensitive mailboxes, and require confirmation before any actions involving credentials or tokens.
