conv.

All stories
SecurityRunning 1d ↳ Gareth Heyes exposes CSS vulnerabilities in major webmail clients

PortSwigger researcher reveals CSS attacks stealing passwords across major webmail services

Techniques bypassing HTML sanitization in Outlook, Gmail, Yahoo Mail and others can capture credentials and tokens, with some fixes deployed but vulnerabilities persisting.

4 items9 engagement0 comments MastodonGoogle News

Conversation activity · last 2 days peak 3/hr

Peak 3 items in one hour at Aug 8, 3 AM; 4 items over 2 days Aug 8, 3 AM — 3 itemsAug 8, 4 AM — no itemsAug 8, 5 AM — no itemsAug 8, 6 AM — no itemsAug 8, 7 AM — no itemsAug 8, 8 AM — no itemsAug 8, 9 AM — no itemsAug 8, 10 AM — no itemsAug 8, 11 AM — no itemsAug 8, 12 PM — no itemsAug 8, 1 PM — no itemsAug 8, 2 PM — no itemsAug 8, 3 PM — no itemsAug 8, 4 PM — no itemsAug 8, 5 PM — no itemsAug 8, 6 PM — no itemsAug 8, 7 PM — no itemsAug 8, 8 PM — no itemsAug 8, 9 PM — no itemsAug 8, 10 PM — no itemsAug 8, 11 PM — no itemsAug 9, 12 AM — no itemsAug 9, 1 AM — no itemsAug 9, 2 AM — no itemsAug 9, 3 AM — no itemsAug 9, 4 AM — no itemsAug 9, 5 AM — no itemsAug 9, 6 AM — no itemsAug 9, 7 AM — no itemsAug 9, 8 AM — no itemsAug 9, 9 AM — no itemsAug 9, 10 AM — no itemsAug 9, 11 AM — no itemsAug 9, 12 PM — no itemsAug 9, 1 PM — no itemsAug 9, 2 PM — no itemsAug 9, 3 PM — no itemsAug 9, 4 PM — no itemsAug 9, 5 PM — no itemsAug 9, 6 PM — no itemsAug 9, 7 PM — 1 itemAug 9, 8 PM — no itemsAug 9, 9 PM — no itemsAug 9, 10 PM — no itemsAug 9, 11 PM — no itemsAug 10, 12 AM — no itemsAug 10, 1 AM — no itemsAug 10, 2 AM — no itemsAug 10, 3 AM — no itemsAug 10, 4 AM — no itemsAug 10, 5 AM — no itemsAug 10, 6 AM — no itemsAug 10, 7 AM — no itemsAug 10, 8 AM — no itemsAug 10, 9 AM — no items 3 items · 3 AM
Aug 9Aug 10

Summary, timeline and people extracted by Claude from 4 items across 2 sources · 19h ago. Quotes are verbatim.

Security researcher Gareth Heyes presented research at Black Hat USA 2026 demonstrating CSS-based attacks that escape email message boundaries and interfere with webmail interfaces, enabling password capture, token theft, and account takeover across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. While some providers have patched specific vulnerabilities, others including Outlook and Gmail still show exploitable weaknesses, and the techniques also pose risks to AI-powered email tools.

  • CSS injection attacks can escape email message boundaries and manipulate webmail UI, enabling password theft, token exfiltration, and account takeover across six major email providers.
  • Attacks exploit gaps between HTML sanitizers and browser parsing, using allowed CSS properties, label elements, and media queries to achieve arbitrary code execution contexts.
  • Some providers patched vulnerabilities (Fastmail, Proton Mail), but Outlook and Gmail exploits remained functional at publication; AI-connected email tools present additional risks via indirect prompt injection.
  • Webmail providers should sandbox HTML email in iframes and restrict CSS, custom attributes, select menus, and external image requests.

How it unfolded

  1. Report Coverage published by security news outlets

    The Hacker News, securityaffairs.com, and SecNews.gr reported on the research findings, highlighting risks to both traditional webmail and AI-powered email processing tools.

  2. Event Research published on CSS webmail vulnerabilities

    PortSwigger researcher Gareth Heyes published detailed research on CSS-based attacks affecting multiple webmail providers, with proof-of-concept code demonstrating password capture and token theft techniques.

  3. Event Patch status at publication: mixed results

    Fastmail had fixed two CSS mutation bugs and Proton Mail's proxy bypass no longer worked, but Outlook label-jacking and Gmail's image-set() bypass remained exploitable.

What people are saying verbatim

“Outlook shows how the pieces can combine. Allowed label elements can trigger controls outside the message, while application JavaScript can turn sanitized custom attributes into new DOM nodes carrying CSS outside the sanitizer's allow list.”

Gareth Heyes, PortSwigger researcher · The Hacker News · Aug 7

“The paper recommends isolating HTML email in sandboxed iframes and tightly restricting CSS, custom attributes, select menus, and image requests.”

Research findings, CSS webmail attack research · The Hacker News · Aug 7