Attackers can escape the boundaries of an email message and interfere with the webmail interface itself, capturing passwords, hijacking accounts, and leaking authentication tokens across multiple major providers. New research presented at Black Hat USA 2026 by PortSwigger researcher Gareth Heyes on August 6 demonstrates attack chains affecting Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. The techniques exploit how webmail platforms handle HTML and CSS inside messages, allowing hostile content to break out and manipulate the trusted interface around it.

One demonstration chain targeting Outlook and Firefox creates a fake Microsoft login screen and records the password a user enters. A separate Yahoo and AOL attack exploits a paste race condition in Firefox — when a victim copies attacker-controlled CSS to their clipboard and pastes it into a draft, the brief window before sanitization kicks in can expose enough of a 12-character Medium email-login token for the attacker's server to piece it together and sign in as the victim. A Gmail attack chain tied to Cowork can steal a Slack token after prompt injection and user interaction. The research is proof-of-concept and doesn't report active exploitation in the wild, though public proof-of-concept code remained available as of August 8.

According to the researcher, Fastmail patched two CSS mutation bugs and a Proton Mail proxy bypass stopped functioning when he retested it, while Outlook label-jacking and Gmail's image-set() bypass still worked when the work was published on August 6. The paper doesn't state whether the complete Outlook password-capture chain was remediated. The report recommends webmail providers isolate HTML email in sandboxed iframes and tightly restrict CSS, custom attributes, select menus, and image requests.

The attacks follow two strategies: abusing HTML and CSS that webmail platforms already permit, or engineering a mismatch between what a sanitizer approves and what the browser or application ultimately renders. Both can cross the line between untrusted message content and the trusted interface surrounding it. Outlook illustrates how components stack together — permitted label elements can activate controls outside the message, while application JavaScript can convert sanitized custom attributes into fresh DOM nodes carrying CSS the sanitizer never saw. A media-query parsing trick then delivered arbitrary CSS to the attacker. The chain disguises a select element as a password field, and Firefox resets its roughly one-second option-selection timer when the select moves offscreen, making password capture happen in real time. AI-connected email opens another avenue — Gmail's image-set() fallback could trigger an external request despite sanitization, and Heyes and colleague Pete Hendy chained it to an indirect prompt-injection email processed by Anthropic's Claude Cowork through a connected Gmail connector. In the demonstrated setup, after the attacker triggered a Slack token confirmation email and the victim asked Cowork to process their emails, the injected instructions caused it to retrieve the token and place it in an HTML draft, and viewing the draft leaked it. OpenAI is deprecating its Atlas AI browser, which is scheduled to stop working on August 9, 2026.

The defensive guidance starts with strict isolation, then character allow lists for CSS validation, checks for CSS gadgets before permitting custom attributes, blocking select menus and dangerous selectors, and preventing attacker-controlled image requests and allow-listed domains. Other findings include Fastmail "CSS hotwiring," which can redirect clicks into unintended and multi-step UI actions, and an escaped-backslash Fastmail image-proxy bypass relying on an allow-listed user.fm domain to reveal when an email is viewed. Heyes separately demonstrated a Proton Mail vector that exposed the recipient's IP address, even though Proton's current tracker-protection documentation says the service is designed to hide a user's personal IP address and exact email-open time. The accompanying public repository contains proof-of-concept code for the disclosed techniques. Webmail platforms face a foundational trade-off between rendering rich messages and isolating hostile markup, and this research suggests the balance has tipped too far toward expressiveness. Organizations relying on webmail for sensitive communications may need to revisit their assumptions about what an email can do once it lands in the inbox.