Webmail Vulnerability Exposes Personal Data to CSS Attacks: A Threat to AI-Powered Email Tools
Recent research has discovered a serious vulnerability in webmail services that can expose millions of personal data to potential threats, including hackers using plain old HTML and CSS attacks. The attacks can steal credentials, hijack sessions, and even manipulate AI tools connected to users' inboxes.
The recent discovery of a webmail vulnerability has exposed millions of personal data to potential threats, including hackers using plain old HTML and CSS (Cascading Style Sheets) attacks. The researchers from PortSwigger have demonstrated how these attacks can steal credentials, hijack sessions, and even manipulate AI tools connected to users' inboxes.
The core idea behind this vulnerability is that email clients allow untrusted HTML and CSS to pass through with the assumption that styling cannot reach outside the message it's attached to. However, researchers Gareth Heyes found ways to break this assumption using two basic approaches: abusing CSS features webmail already permits or exploiting a gap between what a content sanitizer thinks it approved and what the browser actually renders.
Heyes targeted various email services including Fastmail, OpenAI's Atlas, Firefox, AOL Mail, Yahoo Mail, and Outlook. The Outlook chain is the most alarming one to picture in action, as allowed label elements can trigger controls that live outside the email itself, and the client's own JavaScript can turn sanitized custom attributes into new page elements carrying CSS that bypasses the sanitizer's rules entirely.
Heyes demonstrated a real CSS gadget on Outlook where he used the label-jacking trick to disguise a dropdown menu as a password field. The attack captures whatever the victim types in something close to real-time, thanks to Firefox's one-second selection timer whenever the dropdown moves offscreen.
The Yahoo Mail and AOL Mail opened another door involving copy and paste. In Firefox, HTML pasted into a draft can briefly keep its active styling before sanitization strips it out, allowing an attacker to leak a 12-character login token during a Medium sign-in flow, enough for their server to reconstruct the token and log in as the victim.
There's also a clever workaround for cases where Content Security Policy blocks external resource requests entirely. Given the ability to inject styles and a numeric token displayed as plain text in an email, CSS alone can determine which digits appear and how often, then arrange links so a single click reveals that information to an attacker's server.
The AI-connected piece of this research is where things get genuinely unsettling. Gmail's image-set() fallback could trigger an external request despite sanitization, and Heyes chained that into an indirect prompt-injection email processed by Anthropic's Claude Cowork through a connected Gmail integration. The injected instructions caused it to retrieve the token and place it in an HTML draft; viewing the draft leaked it, exactly the kind of AI-agent trap that turns a normal "summarize my inbox" request into unintended data exposure.
Not every provider is equally exposed right now. Fastmail patched two CSS mutation bugs Heyes reported, and a Proton Mail proxy bypass stopped working when he retested it before publication. However, Outlook's label-jacking trick and Gmail's image-set() bypass still worked as of August 6, and the paper doesn't confirm whether the full Outlook password-capture chain has been fixed at all.
Heyes and PortSwigger published proof-of-concept code publicly alongside the research, and their guidance for webmail providers is fairly specific: isolate HTML email inside sandboxed iframes, restrict CSS to strict character allow-lists, check for dangerous CSS gadgets before permitting custom attributes, and block image requests to anything outside an approved domain list.
This article highlights the importance of understanding and addressing these vulnerabilities in order to protect sensitive data from potential threats. Webmail providers must take immediate action to patch these issues and educate their users on the risks associated with CSS attacks.