PortSwigger researcher Gareth Heyes presented webmail CSS attack chains at Black Hat USA 2026 that affect Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, according to The Hacker News. The proof-of-concept techniques can capture credentials, expose tokens, hijack interface actions, and manipulate AI tools connected to email; the research did not report malicious exploitation.
PortSwigger researcher Gareth Heyes presented proof-of-concept CSS attack chains against major webmail services at Black Hat USA 2026, showing how email content can interfere with a provider's trusted web interface. According to The Hacker News, the research covered Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, with demonstrations involving password capture, token leakage, third-party account takeover, trusted-UI manipulation, and AI tools connected to email.
The research does not report malicious exploitation. The Hacker News reported on August 8 that public proofs of concept remained available, while remediation varied by provider and attack path.
How CSS crosses the email boundary
The attack chains use either HTML and CSS already permitted by webmail sanitizers or mismatches between sanitizer output and the DOM ultimately constructed by the browser or web application, according to The Hacker News. In both cases, untrusted message content can affect controls or rendering outside the message body.
One Outlook and Firefox chain combined several behaviors: allowed label elements could activate controls outside the email, and application JavaScript could transform sanitized custom attributes into DOM nodes with CSS properties not permitted by the sanitizer. The report describes a media-query parsing technique that then enabled arbitrary CSS.
The resulting demonstration made a select element look like a password field. The Hacker News reported that Firefox behavior around an offscreen select element reset an approximately one-second option-selection timer, enabling real-time capture of a password typed into a spoofed Microsoft sign-in screen.
Tokens and AI-connected inboxes
The research also described a Yahoo Mail and AOL Mail paste-race issue in Firefox, where pasted HTML could briefly retain active CSS before sanitization. In a Medium login demonstration, that condition exposed an email-login token that an attacker could use to access the victim's account, The Hacker News reported.
A separate Gmail and Cowork demonstration combined prompt injection with user interaction to exfiltrate a Slack token, according to the report. That scenario extends the security boundary under review beyond the webmail UI itself: AI systems that read, summarize, search, or act on inbox content can become part of an attack path when hostile messages influence their inputs or tool use.
The Hacker News reported that Heyes found Fastmail had fixed two CSS mutation bugs, and that a Proton Mail proxy bypass no longer worked on retest. Outlook label-jacking and Gmail's image-set() bypass were still working when the research was published on August 6; the paper did not establish whether the complete Outlook password-capture chain had been fixed.
For providers, the paper recommends rendering HTML email in sandboxed iframes and more tightly restricting CSS, custom attributes, select menus, and image requests. These recommendations reflect the paper's finding that sanitizer and browser or application behavior can let untrusted message content cross into trusted interface controls.
Key Points #
- 1Heyes demonstrated cross-provider webmail CSS chains that can turn untrusted email markup into credential and token theft paths.
- 2The Gmail and Cowork proof of concept shows inbox-connected AI workflows can extend the consequences of prompt injection.
- 3Webmail sanitizer and browser behavior can allow untrusted email content to cross into trusted interface controls.
Scoring Rationale #
The research targets multiple widely used webmail interfaces and demonstrates credential, session-token, and AI-tool manipulation paths. It is proof-of-concept work with no reported malicious exploitation, but it is highly relevant to teams building email-connected agents and web application sanitizers.
Sources #
Primary source and supporting public references used for this report.
Practice with real Telecom & ISP data
90 SQL & Python problems · 15 industry datasets
[Active Residential CustomersEasy](/problems/sql/active-residential-customers)
[Unlimited Fiber Plans 500Mbps+Medium](/problems/sql/unlimited-fiber-plans-above-500mbps)
[Customer Churn Risk AssessmentHard](/problems/sql/customer-churn-risk-assessment)
250 free problems · No credit card
See all Telecom & ISP problems