Gareth Heyes, PortSwigger researcher, presented the study at Black Hat USA 2026. The research examined attack chains with Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. There has been no report of proof-of-concept attacks being used in the wild, however researchers have warned that vulnerabilities in the way webmail platforms handle HTML and CSS may pose serious security risks. 

In one of the most significant demonstrations, researchers were able to disguise a select element as a password field by combining HTML elements, CSS manipulation, and browser behavior. Through the use of this technique, a victim could enter a password into what appeared to be a genuine Microsoft login interface and be captured as a result. 

An underlying problem stems from the fact that webmail platforms allow untrusted HTML and CSS to be displayed within an otherwise trusted interface. It was discovered that attackers could either take advantage of CSS features already allowed by webmail services or exploit the gap between what the sanitizer approves and what the browser actually renders by exploiting the sanitizer. There are also instances in which applications can utilize JavaScript to create new DOM elements with CSS properties that weren't included in the original allowlist of the sanitizer, resulting in the malicious email content escaping its intended boundaries.

Researchers discovered that Yahoo Mail and AOL Mail were vulnerable to a different vulnerability involving pasted HTML Researchers showed how CSS remains active for a short period of time before sanitization allows the attacker to extract portions of an email login token. A 12-character token can then be reconstructed and used to access the victim's account. A CSS selector can be used to determine which digits appear in an email when Content Security Policy prevents an email from making conventional external requests. 

Using CSS selectors, an attacker can identify which digits appear in an email as well as how frequently they occur. By carefully positioning the links so that only the matching option is visible, the attacker-controlled server will receive the inferred information with only one click, without the need for JavaScript. During the Gmail attack, users were required to ask Cowork to process their affected emails, after which the malicious instructions embedded within the message influenced the way the AI system handled the account information. 

During the demonstration, prompt injection, along with email content, demonstrated how the legitimate access of an AI assistant can be turned into a path to expose sensitive tokens, particularly when the assistant has the ability to read messages and write email drafts. A similar attack against the Atlas browser of OpenAI was demonstrated with Fastmail.

In CSS techniques, malicious instructions are concealed from the user while being visible to the artificial intelligence system, demonstrating that differences in how web content is interpreted by human and machine are potentially dangerous, leading to new attack opportunities. Moreover, the researchers identified techniques for manipulating trusted interface actions, bypassing certain content restrictions, and revealing information, such as the time an email was viewed or the IP address of the recipient, in one Proton Mail demonstration. 

Researchers also demonstrated the potential for revealing the recipient's IP address using Proton Mail's tracker-protection mechanisms. As a result of Proton Mail's tracker-protection mechanism, email senders are not able to obtain the IP address of a user and the precise time of email open, the demonstrated bypass illustrates yet again the vulnerability of CSS and webmail rendering behavior to undermine privacy. 

Fastmail was reported to have fixed two CSS mutation vulnerabilities at the time of publication, while the Proton Mail proxy bypass demonstrated at the time was not observed during retesting. However, the Outlook label-jacking technique and Gmail's image-set() bypass remain effective as of August 6. Additionally, the research did not establish whether all aspects of the Outlook password capture chain had been resolved. 

According to the researchers, HTML email should be contained within sandboxed iframes, strict CSS allowlists should be applied, dangerous selectors and select menus should be blocked, custom attributes should be examined for CSS-based attack gadgets and attacker-controlled image requests should be prevented. As traditional content-sanitization defenses face increasingly sophisticated CSS-based attacks, webmail security is becoming increasingly complex. 

With the advent of artificial intelligence assistants having access to email inboxes and other connected services, providers should strengthen their isolation and rendering controls in order to prevent malicious email content from becoming an avenue for credential theft as well as data exposure.