New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens
- ID
- 12206
- Status
- summarized
- Published
- 08 Aug 2026, 4:03 PM
- Fetched
- 08 Aug 2026, 6:08 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 08 Aug 2026, 6:09 PM
- Tags
- Audience
- developersai_agent_userssaas_founders
What happened
PortSwigger researcher Gareth Heyes presented CSS-based attack chains at Black Hat USA 2026 that break email sandbox boundaries across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. The techniques can capture passwords (Outlook/Firefox chain spoofs a Microsoft sign-in screen), exfiltrate Slack tokens via prompt injection (Gmail/Cowork chain), and manipulate AI tools that read email. Public PoCs remain available as of August 8; some bugs are fixed (Fastmail CSS mutations, Proton Mail proxy bypass) while others still work (Outlook label-jacking, Gmail image-set() bypass).
Why it matters
If you build any product that renders untrusted HTML email or uses AI agents that parse email content, these attack chains show that CSS alone can cross the message-to-interface boundary and exfiltrate tokens or manipulate agent behavior. Review whether your email rendering uses sandboxed iframes with tightly restricted CSS, custom attributes, select menus, and image requests as the paper recommends. The Gmail/Cowork Slack token exfiltration via prompt injection is a concrete example of why AI email-reading tools need untrusted-content isolation beyond traditional sanitizers.
Discussion angle
The Gmail/Cowork chain that exfiltrates a Slack token after prompt injection is the most relevant angle for this audience: it demonstrates that AI tools reading email inherit the full attack surface of HTML/CSS injection, not just text-level prompt injection risks.