CSS in Email Is Now an Exploit Primitive

A password typed into what looks like a Microsoft sign-in prompt inside Outlook can now be captured in real time by the sender of the email you are reading. No JavaScript executes. No attachment opens. No link is clicked. The payload is CSS.

PortSwigger researcher Gareth Heyes presented the work at Black Hat USA 2026 on August 6. It covers six major webmail clients — Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail — and the demonstrated outcomes include password capture, third-party account takeover, token exfiltration, hijacked UI clicks, and manipulation of AI assistants that read mail on the user's behalf. The public repository of proof-of-concept code remains available as of August 8. There is no report of exploitation in the wild.

The core problem: sanitizers approve one thing, browsers build another

Every webmail client renders untrusted attacker-controlled content inside the same DOM as the trusted interface — your folder list, your compose window, your account menu. The security boundary is a sanitizer, not an origin. Heyes attacks that boundary two ways.

• Abuse what the sanitizer already permits. Elements and CSS features on the allow list are combined into a gadget chain that reaches outside the message body.
• Create a parser discrepancy. Feed the sanitizer markup it approves, then rely on the browser or the application's own JavaScript to mutate that markup into something the sanitizer never evaluated.

The second class is the harder one to defend. A sanitizer that is provably correct about the string it inspects is still wrong if the application later rewrites that string into new DOM nodes.

Outlook: a select element disguised as a password field

The Outlook chain is the clearest illustration of how small primitives compose into credential theft. Allowed label elements let attacker content trigger controls that live outside the message boundary — label-jacking. Application JavaScript then converts sanitized custom attributes into new DOM nodes that carry CSS the sanitizer's allow list never covered. A media-query parsing trick escalates that into arbitrary CSS.

With arbitrary CSS in the trusted UI, the attacker styles a select element to look like a password field. The victim types. In Firefox, the roughly one-second option-selection timer resets whenever the select is moved offscreen, so each keystroke is captured and transmitted in real time rather than after a delay. The paper does not state whether the full Outlook password-capture chain has been fixed; label-jacking was confirmed still working at publication.

Exfiltration when CSP blocks outbound requests

Content Security Policy blocking external resource loads is the standard mitigation for CSS-based data leaks. Heyes routes around it with a click-based technique that needs no network request from the page at all.

Given style injection and a numeric token rendered as text in the email, CSS selectors determine which digits appear and how many times each occurs. Non-matching links are hidden; the matching link is stretched across the page. The victim's next click — anywhere — sends the digit set and their frequencies to the attacker's server. It is a lower-bandwidth channel than an image beacon, but for short numeric tokens it is sufficient, and it defeats the assumption that CSP alone contains style injection.

AI connectors turn a rendering bug into a token breach

The AI-adjacent findings are the most operationally significant, because they convert a UI-integrity flaw into direct credential loss in another SaaS product.

On Gmail, the image-set() CSS fallback could still issue an external request despite sanitization — confirmed working at publication. Heyes and PortSwigger colleague Pete Hendy chained it to an indirect prompt injection delivered by email and processed by Anthropic's Claude Cowork through a connected Gmail connector. The attacker first triggers a legitimate Slack token confirmation email. When the victim asks Cowork to process their inbox, the injected instructions cause it to retrieve that token and place it into an HTML draft. Viewing the draft leaks the token out.

A parallel Fastmail demo targeted OpenAI's Atlas AI browser. CSS pseudo-elements and opacity split what the human sees from what the model reads: the visible text is harmless, the hidden text is an instruction. Asking Atlas to translate the visible text caused it to open tabs and encode the victim's name in URL fragments. OpenAI is deprecating Atlas, scheduled to stop working August 9, 2026 — but the technique generalizes to any agent that ingests rendered HTML.

The rest of the findings

• Fastmail "CSS hotwiring" — redirects user clicks into unintended, multi-step UI actions inside the mail client.
• Fastmail image-proxy bypass — an escaped backslash abusing the allow-listed user.fm domain reveals when an email was opened.
• Proton Mail IP disclosure — a separate vector exposed the recipient's IP address, against documentation stating the service is designed to hide personal IP and exact open time.
• Fastmail patched two CSS mutation bugs; a Proton Mail proxy bypass stopped working on retest.

What to do

There is no CVE to track and no patch queue to drain. This is a class of defect in how webmail renders untrusted HTML, and the fixes are architectural on the provider side.

The practical detection angle is weak — CSS payloads look like formatting, and the exfiltration channels here are a click, an image request to an allow-listed domain, or an AI agent doing exactly what it was told. Prioritize the connector inventory. A rendering bug that only defaces a UI is an annoyance; the same bug wired to an agent with mailbox and Slack access is a credential breach.