The CSS ‘Bomb’ Inside Your Inbox: How Advanced Webmail Vulnerabilities Break Message Boundaries

Executive Overview

Modern webmail clients have long relied on HTML sanitizers, sandboxed frames, and strict Content Security Policies (CSPs) to keep malicious code contained. However, groundbreaking security research presented at Black Hat USA 2026 reveals a fundamental flaw in this security model: content inside an email message can escape its intended boundary, leap across trust domains, and actively interfere with the surrounding webmail interface.

Unveiled by Gareth Heyes, a prominent security researcher at PortSwigger, the research exposes a suite of complex attack chains affecting major global email providers, including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. By creatively exploiting Cascading Style Sheets (CSS), parser discrepancies, and sanitization gaps, these techniques allow an attacker to execute severe cyberattacks. The identified vulnerabilities can capture passwords in real time, hijack third-party accounts, exfiltrate sensitive security tokens, manipulate trusted user interface (UI) actions, and even corrupt the behavior of modern Artificial Intelligence (AI) assistants that read and summarize emails.

While the research focuses on proof-of-concept (PoC) demonstrations rather than active in-the-wild exploitation, the implications are severe. Publicly available PoCs underscore how deeply ingrained web standards can be weaponized against users. As email clients increasingly integrate with AI productivity agents and browser-based tools, the traditional inbox has transformed from a passive communication channel into an expansive, highly vulnerable attack surface.

Detailed Chronology: Anatomy of the Attacks

The research published by PortSwigger follows two distinct conceptual paths: abusing HTML and CSS elements already permitted by webmail providers, or exploiting discrepancies between what a sanitizer approves and what the web browser or target application ultimately renders in the Document Object Model (DOM).

1. Real-Time Password Capture in Outlook and Firefox

One of the most alarming attack chains demonstrated at Black Hat 2026 targets Microsoft Outlook viewed through the Firefox browser. This multi-step exploit successfully spoofs a legitimate Microsoft sign-in screen directly inside the user’s interface, capturing credentials as the recipient types them.

The attack leverages a combination of permitted HTML label elements and application JavaScript. When an email is opened, allowed custom attributes are transformed by internal scripts into new DOM nodes carrying CSS selectors that lie entirely outside the sanitizer’s allow list. Utilizing an advanced media-query parsing trick, the attacker gains arbitrary CSS injection capabilities.

The exploit then disguises a native HTML select element to look and behave like a standard password input field. Ordinarily, browsers enforce safety timers (such as a roughly one-second option-selection delay) on select elements. However, the attack circumvents this by dynamically shifting the element off-screen, causing Firefox to reset its timer continuously. This creates a seamless, real-time credential-harvesting vector without raising visual suspicion for the victim.

2. Clipboard Race Conditions and Token Harvesting in Yahoo and AOL

Yahoo Mail and AOL Mail exposed an entirely different, highly creative route centered around clipboard interactions in Firefox. Security analysts discovered that pasted HTML could briefly retain active, malicious CSS before the client-side sanitizer executed its cleaning routines.

In a demonstrated Medium account takeover scenario, an attacker initiates a password-recovery or email-login flow on a third-party platform. The attacker then tricks the victim into copying malicious text containing specialized CSS payloads to their clipboard and pasting it directly into a Yahoo or AOL draft.

Even after sanitization, the resulting cascading style requests reveal precise fragments of the target’s 12-character login token via side-channel data exfiltration. The attacker’s listening server reconstructs the token stitch by stitch, granting the threat actor unauthorized, persistent access to the victim’s third-party account.

3. Click-Based Exfiltration Under Strict CSP Restrictions

When Content Security Policies (CSP) successfully block standard external resource loading—preventing classic data-leakage vectors—attackers can turn to CSS-driven click-exfiltration techniques.

The research demonstrates that if an email contains style injection alongside a numeric token rendered as text, advanced CSS can systematically evaluate the digits:

• Determining which numbers occur and how frequently they appear.
• Visually hiding non-matching links while shifting the correct matching link across the screen layout.
• Forcing the victim to inadvertently click the manipulated link, transmitting the complete token data directly to the attacker’s command-and-control server.

4. AI Tool Manipulation: Gmail, Anthropic Claude, and OpenAI Atlas

As email workflows become intertwined with AI assistants, these boundary-crossing vulnerabilities have expanded to target artificial intelligence agents.

In a Gmail-based attack chain, researchers exploited an image-set() fallback quirk that forced an external network request despite strict sanitization rules. Heyes and PortSwigger colleague Pete Hendy chained this flaw with an indirect prompt-injection email processed by Anthropic’s Claude Cowork via an integrated Google Workspace connector.

Once the attacker triggered a Slack token-confirmation email, the victim asked the AI assistant to summarize or process their unread messages. The injected prompt instructed the AI to extract the newly arrived Slack token, write it into a hidden HTML draft, and display it—automatically leaking the credential when the draft interface loaded.

A parallel demonstration targeted Fastmail in conjunction with OpenAI’s Atlas AI browser. By abusing CSS pseudo-elements and opacity properties, the email displayed harmless, benign text to human readers while feeding hidden instructions directly to the AI model. When the user prompted Atlas to translate the visible text, the hidden instructions forced the browser to open unauthorized tabs and encode the victim’s identity into outgoing URL fragments.

5. Interface Hijacking and Proxy Bypasses

The research cataloged several other subtle yet devastating interface exploits:

• Fastmail "CSS Hotwiring": This vector redirects legitimate user clicks into malicious, multi-step UI actions without the user’s knowledge or consent.
• Image-Proxy Bypasses: Utilizing an escaped-backslash trick, an attacker bypassed Fastmail’s image proxy, leveraging an allow-listed domain (user.fm) to silently track when a target views an email.
• Proton Mail IP Leaks: A discovered vector exposed recipient IP addresses, directly undermining Proton Mail’s built-in tracker-protection framework, which promises to obscure personal IP data and read timestamps.

Supporting Context & Metrics

To fully understand the gravity of these vulnerabilities, one must examine the shifting architectural landscape of email transmission and consumption.

Historically, email vulnerabilities were confined to basic Cross-Site Scripting (XSS) vectors that executed JavaScript payloads inside poorly sanitized message bodies. Modern webmail providers largely neutralized classic XSS by enforcing strict sandboxing and robust sanitization libraries.

However, CSS has long occupied a gray area in web security. Because Cascading Style Sheets are fundamentally designed to alter visual presentation, layout, and user experience, security filters historically granted CSS greater latitude than raw executable scripts. This research proves that CSS is no longer merely a styling tool; it is a fully functional data-exfiltration channel capable of performing logical evaluations, timing manipulations, and UI redressing.

Official Vendor Responses and Patch Status

As of the public disclosure on August 6, 2026, and subsequent updates through August 8, the security community has tracked a mixed patchwork of vendor responses:

• Fastmail: Demonstrating swift remediation, Fastmail patched two critical CSS mutation bugs identified by the research team. However, certain complex UI manipulation vectors required ongoing monitoring.
• Proton Mail: While a specific proxy bypass vector initially worked during testing, subsequent retests by the researcher confirmed that the vector stopped functioning, indicating behind-the-scenes hardening.
• Microsoft Outlook & Google Gmail: Key components of the research—such as Outlook label-jacking and Gmail’s image-set() parsing bypass—remained partially or fully functional at the time of publication. Neither provider has issued a comprehensive statement regarding whether the end-to-end credential-harvesting chains have been fully neutralized.
• OpenAI: Addressing the AI browser vector, OpenAI noted that Atlas—the experimental browser-based agentic workspace tool—was already scheduled for formal deprecation, with support terminating on August 9, 2026.

PortSwigger has released comprehensive proof-of-concept code via a public GitHub repository to encourage webmail developers to overhaul their input-validation engines.

Future Outlook and Defensive Recommendations

The emergence of CSS-based inbox "bombs" signals an urgent need to re-architect how webmail clients handle untrusted markup. As email platforms evolve into rich, interactive web applications tightly coupled with AI agents, the boundary between external content and trusted UI controls must become impenetrable.

To mitigate these risks effectively, security researchers and webmail providers should implement the following multi-layered defensive strategies:

1. Strict HTML and CSS Sandboxing: Email bodies should be rigorously isolated inside strictly sandboxed iframe elements with restricted permissions (e.g., utilizing sandbox attributes without unnecessary privileges).
2. Aggressive CSS Validation: Move away from blacklisting dangerous CSS properties toward strict character and property allow-lists. Sanitizers must actively strip complex pseudo-elements, dynamic media queries, and attribute selectors that can span outside message containers.
3. DOM Mutation Auditing: Implement rigorous checks for CSS gadgets before allowing custom attributes to be rendered into the live DOM.
4. UI Control Restrictions: Completely block interactive form elements—such as select menus, custom label bindings, and hidden input fields—within incoming email markup to prevent UI redressing and credential harvesting.
5. AI Guardrails and Context Separation: For email clients integrated with AI productivity tools, applications must enforce strict data boundaries. AI models should be explicitly trained or programmed to treat ingested email text as untrusted data, ignoring embedded instructions that attempt to alter model behavior or exfiltrate private tokens.

Until webmail providers universally adopt these rigorous isolation principles, the inbox remains vulnerable to sophisticated style-based attacks that turn an everyday communication tool against its user.