Researchers at PortSwigger have disclosed a new class of CSS-based attacks affecting major webmail platforms, including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. The vulnerability stems from CSS code embedded within email messages that can escape the message boundary and interact with the broader webmail interface, bypassing existing security controls.
The attack chains enable threat actors to execute multiple malicious actions without requiring code injection or JavaScript execution. Attackers can inject malicious CSS stylesheets directly into email content to manipulate the webmail UI, capture user credentials including passwords and authentication tokens, hijack third-party account integrations, and intercept session data. The techniques also affect AI-powered email readers, allowing attackers to manipulate automated security tools and summary features.
PortSwigger researcher Gareth (last name not provided in available excerpt) identified the attack surface across webmail providers that fail to properly sandbox email content from active UI elements. The vulnerability exploits CSS selector mechanisms and UI overlay techniques to intercept user interactions before they reach legitimate interface controls.
The risk extends beyond credential theft. Attackers can perform actions on behalf of authenticated users, including sending emails, accessing contacts, or triggering password reset flows. The attacks work because webmail platforms render email content within the same DOM context as their functional UI, creating an implicit trust boundary that CSS can cross.
Each platform implements different rendering engines and security policies, yet all proved vulnerable to variations of the attack. Gmail's iframe sandboxing, for instance, contains email rendering but CSS cascading rules still influence the parent interface. Outlook's message pane layout allows CSS-based pointer events to register on underlying buttons. Fastmail and Proton Mail similarly expose attack surfaces through styling mechanisms meant only for email presentation.
The disclosure follows responsible disclosure timelines with affected vendors. Organizations should treat HTML-formatted email with