CSS Attacks Undermine Webmail and AI Email Tools

The attack chains use either HTML and CSS already permitted by webmail sanitizers or mismatches between sanitizer output and the DOM ultimately constructed by the browser or web application, according to The Hacker News. In both cases, untrusted message content can affect controls or rendering outside the message body.

One Outlook and Firefox chain combined several behaviors: allowed label elements could activate controls outside the email, and application JavaScript could transform sanitized custom attributes into DOM nodes with CSS properties not permitted by the sanitizer. The report describes a media-query parsing technique that then enabled arbitrary CSS.

The resulting demonstration made a select element look like a password field. The Hacker News reported that Firefox behavior around an offscreen select element reset an approximately one-second option-selection timer, enabling real-time capture of a password typed into a spoofed Microsoft sign-in screen.

The research also described a Yahoo Mail and AOL Mail paste-race issue in Firefox, where pasted HTML could briefly retain active CSS before sanitization. In a Medium login demonstration, that condition exposed an email-login token that an attacker could use to access the victim's account, The Hacker News reported.

A separate Gmail and Cowork demonstration combined prompt injection with user interaction to exfiltrate a Slack token, according to the report. That scenario extends the security boundary under review beyond the webmail UI itself: AI systems that read, summarize, search, or act on inbox content can become part of an attack path when hostile messages influence their inputs or tool use.

The Hacker News reported that Heyes found Fastmail had fixed two CSS mutation bugs, and that a Proton Mail proxy bypass no longer worked on retest. Outlook label-jacking and Gmail's image-set() bypass were still working when the research was published on August 6; the paper did not establish whether the complete Outlook password-capture chain had been fixed.

For providers, the paper recommends rendering HTML email in sandboxed iframes and more tightly restricting CSS, custom attributes, select menus, and image requests. These recommendations reflect the paper's finding that sanitizer and browser or application behavior can let untrusted message content cross into trusted interface controls.