New CSS Attacks Break Webmail Defenses to Steal Passwords and Tokens

PortSwigger researcher Gareth Heyes presented a new class of CSS-based webmail attacks at Black Hat USA 2026, demonstrating how content inside an email can escape its message boundary and interfere with the trusted webmail interface. The research spans attack chains against Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, with techniques capable of capturing passwords, taking over third-party accounts, leaking authentication tokens, hijacking trusted UI actions, and manipulating AI tools that read email. The work is presented as proof-of-concept research, with public PoCs available as of August 8, and the paper does not report malicious exploitation in the wild.

In one of the most damaging chains, an Outlook and Firefox attack spoofs a Microsoft sign-in screen and captures the recipient's password in real time. Allowed label elements can trigger controls outside the message body, while application JavaScript converts sanitized custom attributes into new DOM nodes carrying CSS that bypasses the sanitizer's allow list. A media-query parsing trick then grants the attacker arbitrary CSS, which disguises a select element as a password field. Crucially, Firefox resets its roughly one-second option-selection timer when the select moves offscreen, enabling continuous capture of typed credentials. Users can verify their own exposure using our password checker to confirm whether stored credentials may have appeared in known leaks.

Yahoo Mail and AOL Mail exposed a different route through a paste-race vulnerability in Firefox, where pasted HTML briefly retains active CSS before sanitization. In the Medium demonstration, the attacker initiates an email-login flow, the victim copies attacker-supplied CSS to the clipboard, and then pastes it into a draft. The resulting requests leak enough of the 12-character Medium login token for the attacker's server to reconstruct it, enabling sign-in as the victim. The paper also introduces a click-based exfiltration technique for environments where Content Security Policy blocks external resources: given a numeric token rendered as text, CSS can determine which digits occur and how often, hide non-matching links, and leave only the matching link exposed so a victim click delivers the digits to the attacker.

Several providers have already responded. The researcher confirmed that Fastmail fixed two CSS mutation bugs, and a Proton Mail proxy bypass stopped working on retest. However, Outlook label-jacking and Gmail's image-set() bypass still worked at publication on August 6, and the paper does not state whether the full Outlook password-capture chain was fixed. For defense, the paper recommends isolating HTML email in sandboxed iframes and tightly restricting CSS, custom attributes, select menus, and image requests. Both attack paths, abusing HTML and CSS webmail already allows and creating discrepancies between what a sanitizer approves and what the browser ultimately renders, are central to the threat. Anyone concerned about credential exposure can run our email breach checker or a full privacy checkup to review their current security posture.