PortSwigger researcher Gareth Heyes presented email-borne CSS attacks at Black Hat USA 2026 showing that message content can escape its rendering boundary and interfere with the webmail interface itself. The techniques, demonstrated across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, can capture passwords, take over third-party accounts, leak tokens, hijack trusted interface actions, and manipulate AI tools that read email. No malicious exploitation has been reported, and the findings remain proof-of-concept.
Escaping the Message Boundary to Reach the Webmail Interface
Heyes demonstrated that CSS inside an email is not reliably quarantined to the message pane. By manipulating style rules, an attacker can make rendered email content reach past its container and interact with the surrounding webmail application, the researcher told Black Hat attendees. The effect turns a sanitized HTML message into a control surface against the provider’s own interface.
The Outlook-Firefox Chain That Captures a Recipient’s Password
One demonstrated chain targeted Outlook running in Firefox. The email spoofs a Microsoft sign-in screen inside the message, and when the recipient types a password, the crafted CSS captures it. The technique bypasses the visual separation users rely on to distinguish message content from the genuine interface around it.
The Yahoo-AOL Paste Race and Token Reconstruction
On Yahoo Mail and AOL Mail, Heyes described a “paste race” in which pasted HTML briefly retains active CSS before sanitization strips it. Within that window, a Medium email-login token can be reconstructed and used to sign in as the victim. The attack depends on a timing gap that the sanitizers currently do not close.
Manipulating AI Assistants That Read Email
The research extended beyond human recipients. A Gmail and Anthropic Claude Cowork chain used an indirect prompt-injection email processed by the AI assistant through a Gmail connector to exfiltrate a Slack token. In a separate demonstration aimed at OpenAI’s Atlas AI browser, the email-based CSS technique was also used, with the browser scheduled to stop functioning in the same period.
Fastmail Click Hotwiring and the Image-Proxy Bypass
Heyes reported that Fastmail CSS can “hotwire” clicks, redirecting them into unintended multi-step interface actions. A second Fastmail finding involved an escaped-backslash bypass of the provider’s image proxy that revealed when an email was viewed, turning a passive message read into observable telemetry.
Proton Mail IP Exposure and the Limits of Sanitization
A vector against Proton Mail exposed the recipient’s IP address, Heyes found. The provider’s handling of proxied resources left a route through which the sender could learn the recipient’s network location, turning a sanitization gap into a privacy leak.
Vendor Fixes, Residual Defects, and the Open Attack Surface
Fastmail fixed two CSS mutation bugs following the research, according to the researcher’s report. A Proton Mail proxy bypass stopped working on retest, while an Outlook label-jacking technique and a Gmail image-set() bypass still worked as of the publication date. The mixed outcome shows providers patching isolated defects while the broader class of CSS-based interference remains present.
Heyes’s Sandboxed-Rendering Guidance for Webmail Providers
Heyes recommended that webmail providers isolate HTML email in sandboxed iframes, restrict CSS tightly through character allow lists, and check for CSS gadgets before permitting custom attributes. The guidance also calls for blocking select menus and dangerous selectors and preventing attacker-controlled image requests, with only allow-listed domains permitted to load.
Why Email-Borne CSS Threatens Account and Token Security
The findings matter because CSS-based attacks bypass the conventional defense-in-depth assumption that sanitization neutralizes malicious message markup. A password capture or a reconstructed login token converts a one-time phishing read into persistent account access, and the same techniques extend to AI email assistants that now sit on the same message streams. As the demonstrations show, the boundary between untrusted message content and the trusted interface is thinner than most users assume, and the detection burden for email security teams continues to rise as providers close individual bugs rather than the underlying rendering model.
