New research has revealed a series of webmail security techniques that can allow malicious email content to escape the boundaries of a message and interfere with the webmail interface itself.
The techniques were demonstrated across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail and AOL Mail. Depending on the service and attack chain, the methods could potentially capture passwords, steal authentication tokens, take over third-party accounts, manipulate trusted interface actions and even influence AI tools that process email.
PortSwigger researcher Gareth Heyes presented the research at Black Hat USA 2026. One of the most serious demonstrations involved Outlook running in Firefox, where a specially crafted email could disguise a select element as a Microsoft sign-in password field and capture credentials entered by the victim.
The research combines several browser and webmail behaviors. Some attacks abuse HTML and CSS that webmail services already permit, while others create differences between what a sanitizer allows and what the browser or application eventually generates. Those discrepancies can allow untrusted email content to cross into parts of the interface that should normally remain protected.
In the Outlook attack chain, allowed label elements could interact with controls outside the email, while application JavaScript transformed sanitized custom attributes into DOM elements that carried CSS beyond the sanitizer’s restrictions. A media-query parsing technique then provided the attacker with arbitrary CSS capabilities.
The resulting attack could make a select element look like a password field. In Firefox, moving the select element offscreen causes its approximately one-second option-selection timer to reset, allowing the attacker to capture the entered information in real time.
Yahoo Mail and AOL Mail were affected by a different technique involving pasted HTML. In Firefox, malicious HTML pasted into a draft could temporarily retain active CSS before sanitization took place. In the demonstrated Medium account attack, the attacker first initiated an email login process and supplied CSS that the victim copied to the clipboard. When the victim pasted that content into a Yahoo or AOL draft, requests generated by the resulting page could expose enough of a 12-character login token for the attacker’s server to reconstruct it and use it to access the victim’s account.
The research also describes a click-based data-exfiltration technique designed for situations where Content Security Policy prevents CSS from making external requests. When a numeric token is displayed as text inside an email, injected CSS can determine which digits appear and how frequently they occur. It can then hide links that do not match the detected information, leaving a matching link visible to the victim. A click on that link sends information about the digits to the attacker’s server.
Email-connected AI systems introduce another potential attack path. In Gmail, an image-set() fallback could generate an external request despite sanitization. Heyes and PortSwigger researcher Pete Hendy combined this behavior with an indirect prompt-injection email processed by Anthropic’s Claude Cowork through its Gmail connector.
In the demonstration, an attacker triggered a Slack token confirmation email and then had the victim ask Cowork to process the messages. Instructions embedded in the malicious email caused the AI system to retrieve the token and place it inside an HTML draft. When the victim viewed the draft, the information was leaked.
A separate Fastmail demonstration targeted OpenAI’s Atlas AI browser. CSS pseudo-elements and opacity were used to make the human-visible content appear harmless while presenting different hidden instructions to the AI model. When the user asked Atlas to translate the visible text, the hidden instructions caused the browser agent to open tabs and encode the victim’s name into URL fragments.
OpenAI is deprecating Atlas and says the browser is scheduled to stop working on August 9, 2026.
The research also uncovered Fastmail “CSS hotwiring,” which can redirect user clicks into unintended multi-step actions. Another Fastmail technique used an escaped backslash and the service’s allow-listed user.fm domain to bypass image-proxy protections and determine when an email was opened.
Heyes also demonstrated a Proton Mail technique capable of exposing a recipient’s IP address. Proton’s current tracker-protection documentation says the feature is designed to hide a user’s personal IP address and the exact time an email is opened.
The research represents proof-of-concept security work rather than reports of active malicious exploitation. Public proof-of-concept code remains available. Heyes said Fastmail fixed two CSS mutation issues, while a Proton Mail proxy bypass no longer worked when he retested it. However, Outlook label-jacking and Gmail’s image-set() bypass still worked when the research was published on August 6. The paper does not specify whether the complete Outlook password-capture chain has been fixed.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The researchers recommend that webmail providers isolate HTML email inside sandboxed iframes and impose strict restrictions on CSS, custom attributes, select menus and image requests. Other defensive measures include using strict character allow lists when validating CSS, checking custom attributes for CSS-related gadgets, blocking select menus and dangerous selectors, and preventing attacker-controlled image requests and abuse of allow-listed domains.
The research and public proof-of-concept code are available from PortSwigger’s research page and its GitHub repository.
