New analysis exhibits content material inside an e-mail can escape its message boundary and intervene with the webmail interface.
Throughout assault chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the strategies can seize passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI instruments that learn e-mail.
PortSwigger researcher Gareth Heyes offered the work at Black Hat USA 2026. One Outlook/Firefox chain spoofs a Microsoft sign-in display and captures the password a recipient sorts. A Yahoo/AOL paste race can expose a Medium email-login token and let an attacker register because the sufferer. A Gmail/Cowork chain can exfiltrate a Slack token after immediate injection and person interplay.
The paper presents proof-of-concept analysis and doesn’t report malicious exploitation. Public PoCs stay out there as of August 8. The researcher mentioned Fastmail mounted two CSS mutation bugs and a Proton Mail proxy bypass stopped working when he retested it, whereas Outlook label-jacking and Gmail’s image-set() bypass nonetheless labored when the analysis was printed on August 6.
The paper doesn’t state whether or not the total Outlook password-capture chain was mounted. For webmail suppliers, the paper recommends isolating HTML e-mail in sandboxed iframes and tightly proscribing CSS, customized attributes, choose menus, and picture requests.
The analysis follows two paths: abuse HTML and CSS that webmail already permits, or create a discrepancy between what a sanitizer approves and what the browser or utility finally creates. Each can cross the boundary between an untrusted message and its trusted interface.
Outlook exhibits how the items can mix. Allowed label parts can set off controls outdoors the message, whereas utility JavaScript can flip sanitized customized attributes into new DOM nodes carrying CSS outdoors the sanitizer’s enable listing. A media-query parsing trick then gave the attacker arbitrary CSS.
The chain disguises a choose factor as a password subject, and Firefox resets its roughly one-second option-selection timer when the choose strikes offscreen, making seize real-time.
Yahoo Mail and AOL Mail uncovered a unique route. In Firefox, pasted HTML may briefly retain lively CSS earlier than sanitization. Within the Medium demonstration, the attacker initiates an email-login circulation, the sufferer copies attacker-supplied CSS to the clipboard, after which pastes it right into a Yahoo or AOL draft. The ensuing requests reveal sufficient of the 12-character login token for the attacker’s server to reconstruct it, which might then be used to register because the sufferer.
The paper additionally introduces a click-based exfiltration approach for circumstances the place Content material Safety Coverage (CSP) blocks exterior assets. Given model injection and a numeric token rendered as textual content within the e-mail, CSS can decide which digits happen and the way typically, disguise non-matching hyperlinks, and go away the matching hyperlink throughout the web page. A sufferer click on sends the digits and their frequency to the attacker’s server.
AI-connected e-mail creates one other route. Gmail’s image-set() fallback may make an exterior request regardless of sanitization. Heyes and PortSwigger colleague Pete Hendy chained it to an oblique prompt-injection e-mail processed by Anthropic’s Claude Cowork via a related Gmail connector.
Within the demonstrated setup, after the attacker triggered a Slack token affirmation e-mail and the sufferer requested Cowork to course of the emails, the injected directions induced it to retrieve the token and place it in an HTML draft; viewing the draft leaked it.
A Fastmail demonstration focused OpenAI’s Atlas AI browser. CSS pseudo-elements and opacity made the human see innocent textual content whereas the mannequin learn hidden directions. When the person requested Atlas to translate the seen textual content, the hidden immediate induced it to open tabs and encode the sufferer’s title in URL fragments. OpenAI is deprecating Atlas and says it’s scheduled to cease engaged on August 9, 2026.
Different findings embrace Fastmail “CSS hotwiring,” which might redirect clicks into unintended and multi-step UI actions. An escaped-backslash Fastmail image-proxy bypass depends on an allow-listed person.fm area to reveal when an e-mail is considered.
Heyes individually demonstrated a Proton Mail vector that uncovered the recipient’s IP deal with. Proton’s present tracker-protection documentation says the service is designed to cover a person’s private IP deal with and precise email-open time.
The accompanying public repository incorporates PoCs for the disclosed strategies. The defensive steerage begins with strict isolation, then character enable lists for CSS validation, checks for CSS devices earlier than permitting customized attributes, blocking choose menus and harmful selectors, and stopping attacker-controlled picture requests and allow-listed domains.
