A security researcher has demonstrated a series of webmail client vulnerabilities that leverage Cascading Style Sheets (CSS) to steal credentials, hijack sessions, and manipulate AI tools integrated with user inboxes. The research, conducted by Gareth Heyes of PortSwigger, details attack chains against major webmail services including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.
The core of these attacks exploits the assumption that CSS, a styling language, cannot interact with elements outside the email message it is applied to. Heyes identified methods to bypass this assumption by either abusing permitted CSS features or exploiting discrepancies between what a content sanitizer approves and what a browser actually renders. This allows untrusted content within an email to interact with the trusted user interface surrounding it.
One particularly concerning attack chain targets Outlook. Heyes found that allowed label elements could trigger controls external to the email. Furthermore, Outlook's JavaScript could transform sanitized custom attributes into new page elements carrying CSS that completely bypasses the sanitizer's rules. This technique was used to disguise a dropdown menu as a password field. In Firefox, the attack could capture typed characters in near real-time because the browser's roughly one-second selection timer resets whenever the dropdown moves off-screen. Heyes described this as a "CSS gadget" where existing JavaScript appends an element to the Document Object Model (DOM) with a CSS property or value not on the webmail CSS sanitizer's allow list, enabling a break out of trust boundaries. Specifically, Outlook's allowance of custom data attributes, combined with a library that appends elements with `position:fixed`, allowed elements to be positioned anywhere on the page, effectively defacing Outlook's interface.
Yahoo Mail and AOL Mail were susceptible to a different vector involving copy and paste in Firefox. HTML pasted into a draft could briefly retain active styling before sanitization removed it. Heyes exploited this window to leak a 12-character login token during a Medium sign-in process. An attacker could initiate a login via email, create malicious CSS to copy to the clipboard, and if the victim pasted it into a draft, the token would be stolen.
Even in scenarios where Content Security Policy (CSP) blocks external resource requests, CSS alone could be weaponized. If a numeric token was displayed as plain text in an email, CSS could determine which digits appeared and their frequency. By carefully arranging links with selectors and visibility rules, a single click could then reveal this information to an attacker's server without requiring JavaScript.
The research also highlighted significant risks to AI tools connected to email inboxes. In Gmail, an `image-set()` fallback could trigger an external request despite sanitization. Heyes chained this into an indirect prompt-injection email processed by Anthropic's Claude Cowork, which was integrated with Gmail. The injected instructions caused the AI to retrieve a token and place it in an HTML draft, leading to its exposure upon viewing. A separate demonstration against OpenAI's Atlas browser used hidden CSS pseudo-elements to present harmless text to a human while an AI model read a different, hidden instruction.
While some providers have addressed reported issues, others remain vulnerable. Fastmail patched two CSS mutation bugs reported by Heyes, and a Proton Mail proxy bypass was no longer effective upon retesting. However, Outlook's label-jacking technique and Gmail's `image-set()` bypass were still functional as of August 6, and it is unconfirmed whether the full Outlook password-capture chain has been resolved.
Proof-of-concept code has been made public alongside the research. Heyes and PortSwigger recommend that webmail providers isolate HTML email within sandboxed iframes, restrict CSS to strict character allow-lists, check for dangerous CSS gadgets before permitting custom attributes, and block image requests to any domain not on an approved list. These measures aim to mitigate the risks posed by weaponized stylesheets.
