New CSS Attacks Break Webmail Defenses to Steal Passwords and Tokens
New research presented at Black Hat USA 2026 reveals that CSS and HTML techniques can break out of email message boundaries to…
Tag: CSS attacks
Fastmail Fixes CSS Mutation Bugs but Remains Exposed to Hotwiring
Fastmail fixed two CSS mutation bugs and an image-proxy bypass, but CSS hotwiring and other techniques remain a concern for webmail security.
Proton Mail Proxy Bypass Exposes Recipient IP Address
A Proton Mail vector demonstrated that a proxy bypass could expose the recipient's IP address, contradicting Proton's tracker-protection claims.
Yahoo Mail and AOL Mail Paste Race Leaks Login Tokens
A paste race in Yahoo Mail and AOL Mail on Firefox can leak Medium email-login tokens, allowing account takeover.
OpenAI Atlas Browser Vulnerable to Hidden Prompt Injection
CSS pseudo-elements and opacity can hide instructions from humans while AI models like OpenAI's Atlas read them, leading to data exfiltration. Atlas…
PortSwigger Research Exposes CSS Attacks on Webmail
PortSwigger researcher Gareth Heyes presented new CSS-based attacks at Black Hat USA 2026 that can break webmail defenses to steal passwords and…
Black Hat USA 2026 Highlights CSS Attacks on Webmail
At Black Hat USA 2026, PortSwigger researcher Gareth Heyes presented new CSS attacks that break webmail defenses to steal passwords and tokens.
Outlook Vulnerable to CSS Label-Jacking and Password Theft
An attack chain in Outlook and Firefox spoofs a Microsoft sign-in screen and captures passwords by abusing allowed label elements and CSS…
Gmail Image-Set() Bypass Enables Token Exfiltration via AI
Gmail's image-set() fallback can be abused to make external requests, enabling exfiltration of Slack tokens through prompt injection in AI-connected email workflows.