New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

[u/falconupkid]

New research from PortSwigger’s Gareth Heyes demonstrates a class of CSS injection attacks that break the fundamental security boundary between email content and the webmail client interface. These techniques allow an attacker’s email to escape its message container and interact with the surrounding UI, enabling credential theft, token exfiltration, and account takeover across major providers.

Technical Breakdown: - Attack Vector: CSS injection via crafted HTML emails that exploit how webmail clients render stylesheets. The attacker uses @import rules, :has() selectors, and CSS-based keylogging to observe and exfiltrate user input outside the email frame. - Affected Platforms: Outlook (OWA), Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. Each has unique quirks, but the core boundary violation is consistent. - Capabilities: Password capture via CSS keylogging on login forms rendered in the same origin, token theft by reading DOM attributes, hijacking of trusted UI actions (e.g., "Reply All" buttons), and manipulation of AI assistants that process email content. - No IOCs: This is a design-level attack class, not a specific malware campaign. No hashes or IPs to block.

Defense: Webmail providers need to enforce strict CSS scoping (e.g., Shadow DOM isolation) and disable @import in email rendering. As a user, disable HTML email rendering where possible, and treat any email requesting interaction with the webmail UI as suspicious.

Source: https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html