New CSS Attacks Break Webmail Defenses, Steal Passwords

New research from PortSwigger has revealed that content embedded within an email can escape its intended message boundary and interfere directly with the webmail interface itself. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, these techniques enable adversaries to capture passwords, take over third‑party accounts, leak tokens, hijack trusted user interface actions, and even manipulate artificial intelligence tools that read email. The findings were reported by a researcher named Gareth at PortSwigger, who demonstrated how carefully crafted CSS payloads can execute code inside the mail client’s rendering context ¹.

The core issue lies in how most webmail interfaces parse HTML/CSS without sufficient sanitization before rendering it within the user's own browser session. This lack of strict filtering allows malicious stylesheets to inject JavaScript or alter DOM elements, effectively turning a harmless-looking email into a cross‑site scripting (XSS) vector. XSS vulnerabilities have plagued online services since 1999 when they were first documented by Dan Geisler; modern defenses make successful exploitation harder than ever, yet sophisticated attackers still find ways around them ¹.

These attacks require deep knowledge of browser internals combined with careful crafting of input payloads. By positioning style rules that target specific element IDs or classes used by the mail provider’s UI, an attacker can override default behavior—changing button colors, disabling security prompts, or redirecting form submissions to malicious endpoints. Once the victim interacts with the altered interface, credentials are captured and sent to an external server controlled by the attacker. Because many providers render emails directly in the same process as their user interface, there is no clear boundary between message content and application logic.

From a privacy perspective, this means that users who rely on popular free or paid webmail services may unknowingly expose login secrets and authentication tokens whenever they open an infected message. The fact that multiple major platforms share similar rendering engines increases the attack surface: Gmail uses Chrome's V8 engine, Outlook relies on Microsoft Edge components, while Proton Mail runs its own sandboxed renderer—all susceptible if CSS sanitization is lax. Organizations using these services for internal communications face elevated risk of credential compromise, potentially leading to account takeover or lateral movement within corporate networks.

While the research highlights a serious flaw, it also underscores how modern webmail’s convenience—rendering rich media directly in the inbox—comes at the cost of increased complexity in sanitizing user data. As AI tools increasingly read emails to provide contextual assistance, attackers who can hijack UI actions may gain further leverage, turning benign features into vectors for social engineering. The findings serve as a reminder that seemingly innocuous design choices can have far‑reaching privacy implications when combined with sophisticated attack techniques.