CSS Email Attacks Breach Webmail Boundaries to Steal Passwords and Tokens

Researchers disclosed a set of HTML/CSS-only attack chains that let malicious emails break out of normal message boundaries in major webmail clients, enabling password capture, token leakage, UI action hijacking, and even keylogging-like behavior without JavaScript or attachments. The findings, presented by PortSwigger's Gareth Heyes, showed that modern CSS features can be abused to interfere with trusted interface elements in services including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, turning routine email rendering into a path for account takeover and data exfiltration.

The research said some flaws were fixed after disclosure, including two CSS mutation bugs in Fastmail and a Proton Mail proxy bypass that no longer worked on retest, while Outlook label-jacking and Gmail image-set()-based bypasses still worked when the paper was published. Researchers said they found no evidence of active exploitation, but public proof-of-concept techniques remained available, and they urged vendors to isolate HTML email in sandboxed iframes, strengthen sanitization, and more tightly restrict CSS, custom attributes, select menus, and image requests because end users have little practical ability to disable CSS in webmail.