In a startling revelation that underscores the persistent vulnerabilities within our most trusted digital communication platforms, groundbreaking research has exposed a new class of CSS-based attacks capable of bypassing webmail defenses. These sophisticated techniques, demonstrated across major platforms like Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, threaten to compromise user data, from passwords and authentication tokens to sensitive AI interactions.
The Alarming Scope of CSS Webmail Attacks
Presented by PortSwigger researcher Gareth Heyes at Black Hat USA 2026, this work highlights how seemingly innocuous content within an email can “escape” its intended message boundary. Once unleashed, this rogue CSS can interfere with the webmail interface itself, leading to a cascade of potential breaches. The implications are profound: attackers could capture login credentials, hijack third-party accounts, leak critical tokens, manipulate trusted UI elements, and even subvert AI tools designed to process emails.
Key Attack Vectors and Their Impact
- Outlook/Firefox Password Capture: One particularly insidious chain demonstrated how attackers could spoof a Microsoft sign-in screen within Outlook, capturing the recipient’s password in real-time. This exploit leveraged allowed label elements to trigger controls outside the message and application JavaScript to introduce malicious CSS through sanitized custom attributes.
- Yahoo/AOL Token Exfiltration: A “paste race” technique affecting Yahoo Mail and AOL Mail in Firefox revealed how an attacker could expose a Medium email-login token. By copying attacker-supplied CSS to the clipboard and pasting it into a draft, victims inadvertently allowed the attacker’s server to reconstruct their login token, enabling unauthorized access.
- Gmail/Cowork Slack Token Leak: AI-connected email services present a new frontier for exploitation. A Gmail vulnerability, combined with Anthropic’s Claude Cowork, allowed for the exfiltration of a Slack token. This involved an indirect prompt-injection email that, when processed by Cowork, retrieved the token and placed it into an HTML draft, leaking it upon viewing.
Beyond Traditional Defenses: How the Attacks Work
Heyes’ research delves into two primary avenues for these attacks: exploiting existing HTML and CSS functionalities that webmail providers permit, or creating a subtle disparity between what a sanitizer approves and what the browser or application ultimately renders. Both methods effectively bridge the gap between an untrusted email message and the trusted webmail interface.
For instance, the Outlook attack chain cleverly disguised a <select> element as a password field. Firefox’s behavior of resetting its option-selection timer when the <select> element moves off-screen made real-time password capture feasible.
Click-Based Exfiltration and AI Manipulation
Even when Content Security Policy (CSP) blocks external resources, attackers have found ways. A novel click-based exfiltration technique allows CSS to identify digits within a numeric token rendered as text. By selectively hiding non-matching links and leaving only the matching one visible, a victim’s click can transmit the token digits and their frequency to an attacker’s server.
The research also highlighted the risks with AI. Beyond the Slack token leak, a Fastmail demonstration targeting OpenAI’s Atlas AI browser showed how CSS pseudo-elements and opacity could display harmless text to a human user while simultaneously presenting hidden, malicious instructions to the AI model. This allowed the AI to open tabs and encode the victim’s name in URL fragments, demonstrating a profound level of AI manipulation.
The Path Forward: Strengthening Webmail Security
While some vulnerabilities have been addressed—Fastmail fixed two CSS mutation bugs, and a Proton Mail proxy bypass was resolved—others, like Outlook label-jacking and Gmail’s image-set() bypass, remained active at the time of publication. The full Outlook password-capture chain’s status remains unclear.
For webmail providers, the paper offers crucial defensive guidance:
- Strict Isolation: HTML emails should be isolated within sandboxed iframes.
- Tight CSS Restrictions: Implement stringent character allow lists for CSS validation.
- Attribute Scrutiny: Thoroughly check for CSS “gadgets” before permitting custom attributes.
- Dangerous Element Blocking: Block
<select>menus and other dangerous selectors. - Image Request Control: Prevent attacker-controlled image requests and carefully manage allow-listed domains.
This research serves as a critical warning, urging both users and webmail providers to re-evaluate and reinforce their security postures against these evolving and sophisticated CSS-based threats.
Stay informed on the latest cybersecurity threats and solutions by following us on Google News, Twitter, and LinkedIn.
For more details, visit our website.
Source: Link
Leave a comment