New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

The sanctity of the digital inbox has been called into question following the revelation of a sophisticated class of vulnerabilities targeting the world’s most prominent webmail providers. New research from PortSwigger’s Gareth Heyes demonstrates that the traditional visual boundaries separating an email’s content from the surrounding webmail interface are far more porous than previously understood. By leveraging Cascading Style Sheets (CSS), attackers can execute "stylesheet injection" attacks that break out of the message body to manipulate the parent application's User Interface (UI). This research spans the entire spectrum of the industry, identifying critical weaknesses in Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.

This discovery highlights a long-standing tension between functionality and security in web design. For decades, email clients have allowed a subset of CSS and HTML to enable rich, branded communication. However, the complexity of modern web applications—which integrate account settings, third-party integrations, and now AI assistants into a single browser window—has created a vast attack surface. While most security protocols focus on blocking malicious JavaScript, the "CSS-only" approach bypasses traditional filters. The premise is deceptively simple: if an attacker can inject a style tag that isn't properly sanitized, they can redefine how the entire web page looks and behaves, potentially overlaying invisible forms or redirecting clicks to malicious destinations.

Mechanically, these attacks rely on "CSS exfiltration" and "UI redressing." By exploiting specific CSS selectors and properties, a malicious email can "reach out" of its sandbox. In one instance, researchers demonstrated how a carefully crafted stylesheet could capture a user’s password or CSRF (Cross-Site Request Forgery) token by styling elements outside the email frame to report their content back to an attacker-controlled server. More alarmingly, the research showed how these techniques could be used to manipulate integrated AI tools. By injecting hidden text that only the AI "sees" via the DOM (Document Object Model), an attacker can influence the AI's summaries or trigger unintended actions, effectively performing a prompt injection via a stylized email.

The implications for the cybersecurity industry are profound, particularly regarding the concept of "trusted UI." Users are conditioned to believe that as long as they do not click a suspicious link or download an attachment, they are safe. This research proves that merely opening or previewing an email can be sufficient for compromise. For enterprise environments, the risk is compounded; an attacker could exfiltrate internal session tokens or administrative credentials simply by sending a message to a high-privileged user. This forces a reevaluation of how webmail providers sanitize content, shifting the focus from blocking specific "bad" tags to a more restrictive "allow-list" approach that may inadvertently break legitimate email formatting.

From a market perspective, this puts providers like Proton Mail and Fastmail—who market themselves on superior privacy and security—in a difficult position. The fact that even encrypted and security-focused platforms were susceptible underscores the fundamental difficulty of rendering third-party content safely. The research also serves as a warning for the burgeoning AI-agent market. As companies rush to integrate Large Language Models (LLMs) that can read and act on user emails, they are inadvertently creating new vectors for automated exploitation. If an email can modify the UI or the data the AI consumes, the AI becomes a weaponized tool for the attacker rather than an assistant for the user.

Moving forward, the tech industry must watch for a significant overhaul in email rendering engines. We are likely to see a push toward stricter adoption of Content Security Policy (CSP) headers and the use of the `sandbox` attribute for iframes to enforce rigid isolation. Additionally, the development of "safe" CSS subsets specifically for email will likely gain momentum. As webmail providers patch these specific exploits, attackers will undoubtedly look for more esoteric CSS features to bypass new filters. The battle for the inbox has moved beyond the attachment and the link, settling into the very code that defines how we see the digital world.