New CSS Attacks Break Webmail Defenses to Steal Passwords and Tokens

New research presented at Black Hat USA 2026 reveals that CSS and HTML techniques can break out of email message boundaries to compromise webmail interfaces, potentially stealing passwords, tokens, and sensitive data across major providers including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.

Researcher Gareth Heyes of PortSwigger demonstrated multiple attack chains. One Outlook/Firefox chain spoofs a Microsoft sign-in screen to capture passwords. A Yahoo/AOL paste race can expose a Medium email-login token, allowing account takeover. A Gmail/Cowork chain can exfiltrate Slack tokens via prompt injection. The research also shows how AI-connected email tools, such as Anthropic’s Claude Cowork and OpenAI’s Atlas browser, can be manipulated to leak data.

The attacks exploit allowed CSS features, sanitizer bypasses, and discrepancies between what sanitizers approve and what browsers render. Defensive recommendations include isolating HTML email in sandboxed iframes, restricting CSS and custom attributes, blocking select menus and dangerous selectors, and preventing attacker-controlled image requests. The paper notes that Fastmail fixed two CSS mutation bugs and a Proton Mail proxy bypass stopped working, while Outlook label-jacking and Gmail’s image-set() bypass remained effective as of publication.