CSS in Emails: How Mail Styling Turns Into Password and Token Theft

PortSwigger researcher Gareth Heyes presented work at Black Hat USA 2026 showing that the HTML and CSS styling of an email can “break out” beyond the message itself and interfere with the webmail interface. The attack chains affected Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail and AOL Mail, and made it possible to intercept passwords, hijack third-party accounts, leak tokens, spoof trusted UI elements and manipulate AI tools that read mail.

The idea rests on two paths: either abuse the HTML and CSS that mail already permits, or create a discrepancy between what the sanitizer approves and what the browser or app ultimately builds. Either way, it crosses the boundary between an untrusted email and a trusted interface.

Passwords and tokens

In the Outlook + Firefox combination, an attacker disguises a select element as a password field and fakes the Microsoft sign-in screen. Firefox resets the roughly one-second option-selection timer when the element moves off-screen — and the typed password is intercepted in real time.

Yahoo Mail and AOL Mail opened up another path: in Firefox, inserted HTML briefly retained active CSS before sanitization. In a demonstration with Medium, the victim copies attacker-prepared CSS and pastes it into a draft — the outgoing requests reveal enough of the 12-character login token for the attacker to reconstruct it and log in under someone else's account.

For cases where Content Security Policy blocks external resources, Heyes proposed a “click-based” leak: the CSS determines which digits of the token are present and how often, hides the non-matching links and leaves one — the victim's click sends the data to the server.

The target is AI

A separate group of attacks targets AI connected to mail. In Gmail, the image-set() fallback mechanism allowed an external request to be made despite sanitization; combined with indirect prompt injection through Claude Cowork, this led to the theft of a Slack token that had ended up in an HTML draft. A demonstration with Fastmail hit OpenAI's Atlas browser: pseudo-elements and transparency showed a human harmless text, while the model read hidden instructions and encoded the victim's name into a URL.

Some of the problems have already been fixed: Fastmail patched two CSS mutation bugs, and the proxy bypass in Proton Mail no longer works. However, label-jacking in Outlook and the image-set() bypass in Gmail were still working as of publication. The work is proof-of-concept in nature, no cases of malicious exploitation have been recorded, and the public PoCs remain available.

For defenders, Heyes advises isolating HTML emails in a sandboxed iframe and strictly restricting CSS, custom attributes, selection menus and image requests.

Source: The Hacker News