Email CSS Attacks Can Escape Webmail Boundaries to Steal Credentials and Tokens

Aug 8, 2026 · Original article ↗

Summary

PortSwigger researchers showed how HTML and CSS in email can escape webmail message boundaries to steal credentials and tokens, hijack UI actions, and manipulate AI email tools. Proofs of concept span major providers; some issues were fixed, while others remained.

Key points

PortSwigger researchers presented proof-of-concept attacks that exploit permitted email HTML and CSS or differences between sanitizer checks and browser behavior to cross the boundary into trusted webmail interfaces.
An Outlook and Firefox chain combines allowed labels, application-generated DOM elements, and a CSS parsing trick to spoof a Microsoft sign-in screen and capture a password. The paper does not say whether the full chain was fixed.
A Yahoo Mail and AOL Mail paste-race demonstration used briefly active CSS to reveal enough of a Medium email-login token for an attacker to reconstruct it.
A Gmail image-set() fallback was chained with indirect prompt injection in Claude Cowork: after the user asked it to process email, the tool retrieved a Slack token and placed it in a draft that leaked when viewed.
A separate CSS technique can encode digits from a token displayed in an email into links, which disclose the digits when a victim clicks the matching link.
Other demonstrations include Fastmail click hijacking and hidden instructions targeting OpenAI Atlas, plus a Proton Mail technique that exposed a recipient's IP address.
Fastmail fixed two CSS mutation bugs, and a Proton Mail proxy bypass stopped working on retest; the researchers said Outlook label-jacking and Gmail's image-set() bypass still worked when published. Recommended defenses include sandboxed email frames and strict CSS and image-request restrictions.

Article Details

Attack Vectors: HTML and CSS in email can escape the message boundary and manipulate trusted webmail interfaces, including through discrepancies between sanitizer approval and the DOM or CSS ultimately created.
An Outlook and Firefox proof of concept uses label elements, sanitized custom attributes, CSS, and a select element disguised as a password field to capture a recipient's typed password.
A Yahoo Mail and AOL Mail proof of concept exploits a paste-time sanitization race: attacker-supplied CSS copied and pasted into a draft can expose parts of a Medium email-login token.
Injected CSS can infer digits in a numeric token rendered in an email, hide non-matching links, and reveal digit values and frequencies when the victim clicks the remaining link.
A Gmail image-set() fallback can make an external request despite sanitization. In a demonstration, indirect prompt injection in email processed by Claude Cowork caused a Slack token to be placed in an HTML draft, which leaked when viewed.
Fastmail CSS can redirect clicks into unintended UI actions. A separate demonstration used CSS to conceal instructions from the human while an AI browser read them and acted on them.
A Fastmail image-proxy bypass using an escaped backslash and an allow-listed user.fm domain can reveal when an email is viewed.
A Proton Mail demonstration exposed the recipient's IP address.
Defensive Notes: Isolate HTML email in sandboxed iframes and tightly restrict CSS, custom attributes, select menus, and image requests.
Use character allow lists when validating CSS, check for CSS gadgets before allowing custom attributes, block select menus and dangerous selectors, and prevent attacker-controlled image requests and allow-listed domains.
The researcher said Fastmail fixed two CSS mutation bugs. A Proton Mail proxy bypass stopped working when retested; the article does not state whether the full Outlook password-capture chain was fixed.