How a CSS border escape compromised the world's most trusted webmail interfaces

I remember sitting in a windowless Security Operations Center three years ago, watching a red teamer bypass a multi-million dollar web application firewall with a single encoded character. It was a humbling reminder that complexity is the enemy of security. We often assume that the more we spend on a defensive layer, the more certain its protection is. This belief is a fallacy. Recent research presented by PortSwigger's Gareth Heyes at Black Hat USA 2026 proves that even the most mature webmail platforms are vulnerable to style-based attacks.

Webmail providers like Gmail, Outlook, and Proton Mail spend millions on sanitization engines. These systems act like a VIP club bouncer at every internal door. They scan every incoming HTML email for malicious scripts and dangerous tags. If a piece of code looks suspicious, the sanitizer strips it out. This research shows that an attacker does not need JavaScript to cause harm. They only need Cascading Style Sheets (CSS). By exploiting how browsers and webmail clients interpret style, an attacker can jump the fence between an untrusted email and the trusted application interface.

The architectural paradox of email sanitization

The fundamental problem is the boundary. When you open an email, the webmail client places that untrusted content inside its own trusted UI. There is a thin wall between the message and your "Inbox" or "Settings" buttons. Usually, this wall is a series of filters that prevent the email from affecting the rest of the page. This research demonstrates how CSS can reach through that wall.

One path involves abusing HTML and CSS that the sanitizer already allows. The other path creates a discrepancy between what the sanitizer approves and what the browser ultimately renders. Both paths lead to the same result. The email content interferes with the webmail interface. This can lead to password theft, token leakage, and unauthorized UI actions. It is a systemic failure of the isolation model we have relied on for decades.

The Outlook password capture chain

The most dramatic finding involves Outlook and Firefox. This attack chain is a masterclass in combining minor browser behaviors to achieve a critical compromise. The researcher used allowed label elements to trigger controls outside the email message. Then, a media-query parsing trick allowed the injection of arbitrary CSS that the sanitizer missed.

Inside the email, the attacker disguises a standard select element as a Microsoft sign-in screen. This is where the Firefox behavior comes in. Firefox has an internal timer of about one second for selection menus. If the select element moves offscreen, the browser resets this timer. By moving the element strategically, the attacker makes the capture happen in real time. When a user thinks they are typing their password into a trusted prompt, they are actually feeding it directly to the attacker. This technique bypasses traditional phishing warnings because the URL in the address bar is still outlook.live.com.

The Yahoo and AOL paste race

Yahoo Mail and AOL Mail revealed a different vulnerability rooted in how browsers handle the clipboard. In Firefox, pasted HTML can briefly retain active CSS before the application's sanitizer has a chance to clean it. This is a "paste race." The research demonstrated this by targeting Medium email-login tokens.

In this scenario, the attacker initiates a login flow for the victim's Medium account. The victim receives a legitimate login email. However, the attacker has already sent a separate email containing malicious CSS. The victim copies this content and pastes it into a draft in Yahoo or AOL. During that split second of the paste, the malicious CSS makes requests to the attacker's server. These requests reveal enough characters of the 12-digit login token for the server to reconstruct the full code. The attacker then uses that token to sign in as the victim. The entire process relies on a race condition that occurs in the blink of an eye.

Token exfiltration through prompt injection

The rise of AI-connected email tools creates a new attack surface. Gmail provides a clear example through its image-set() fallback behavior. Despite sanitization efforts, this CSS function can still make external requests. Gareth Heyes and Pete Hendy chained this with an indirect prompt injection attack. This specifically targeted users of Anthropic's Claude Cowork tool, which connects to Gmail to process messages.

An attacker sends an email with hidden instructions for the AI. When the victim asks Claude to process their recent emails, the AI follows the injected instructions instead of the user's command. In the demonstration, the AI retrieved a Slack token from a separate confirmation email and placed it into a new HTML draft. When the victim viewed that draft, the image-set() bypass exfiltrated the token to the attacker. This turn of events shows how AI agents can become a digital Trojan horse within a secure environment.

Fastmail and the art of CSS hotwiring

Fastmail was vulnerable to what the researcher calls "CSS hotwiring." This technique redirects clicks into unintended, multi-step UI actions. By using CSS pseudo-elements and opacity, an attacker can overlay invisible buttons on top of the legitimate Fastmail interface. A user who thinks they are clicking a link in an email might actually be clicking a button that deletes their inbox or changes their account settings.

This research also targeted OpenAI's Atlas AI browser. An attacker can use CSS to show one thing to a human and another to a machine. For example, the human sees a harmless paragraph of text. The AI model reads hidden instructions encoded in the CSS. When the user asks Atlas to translate the visible text, the hidden instructions cause the browser to open new tabs and leak the victim's name in the URL fragments. While OpenAI is deprecating Atlas on August 9, 2026, the technique remains a warning for any developer building AI that interacts with the web.

Privacy leaks in Proton Mail

Even privacy-focused services like Proton Mail are not immune. The researcher demonstrated a vector that exposed a recipient's IP address. Proton Mail is designed to hide this information from senders through tracker protection. However, a specific CSS bypass allowed an external request to fire when the email was opened. This revealed the exact time the email was read and the user's personal IP address. Proton has since addressed certain proxy bypasses, but the research highlights the difficulty of maintaining a perfect perimeter in a world of complex CSS.

Strengthening webmail against style attacks

These findings suggest that our current approach to email security is reactive. We wait for a researcher to find a bypass and then we patch it. For webmail providers, the defensive guidance is now much more stringent. The most effective defense is total isolation. This means rendering HTML emails inside sandboxed iframes. This prevents the email style from ever reaching the parent UI.

Providers must also restrict CSS properties to a strict allow-list of safe characters. They should block select menus, custom attributes, and dangerous selectors like :has(). Furthermore, they must prevent all attacker-controlled image requests, even those that appear to come from allow-listed domains. From an end-user perspective, the best defense is a healthy paranoia. Be wary of any email that asks you to copy and paste content or interact with unusual UI elements.

Key Takeaways for Security Teams

• Implement strict iframe sandboxing for all untrusted HTML content.
• Validate CSS against a character-based allow-list rather than a tag-based block-list.
• Audit the interaction between AI assistants and the email DOM to prevent indirect prompt injection.
• Disable dangerous CSS features like image-set() and complex pseudo-selectors in the email body.
• Review the behavior of custom HTML attributes that JavaScript might later transform into active elements.

Sources:

• PortSwigger Research: Gareth Heyes, Black Hat USA 2026 Paper
• NIST Special Publication 800-45 Version 2: Guide to Electronic Mail Security
• MITRE ATT&CK Framework: T1566 (Phishing) and T1189 (Drive-by Compromise)

This article is for informational and educational purposes only and does not replace a professional cybersecurity audit or incident response service.