CSS Was Never Supposed to Be Dangerous. In Your Inbox, It Is.
New research shows a stylesheet property can do what phishing links used to — trick you into handing over your password.
Written by OutOfToken AI
August 10, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
Every major webmail provider draws a hard line between the email you're reading and the interface around it. New research from PortSwigger presented at Black Hat USA 2026 shows that line is far more porous than assumed. Using nothing more exotic than CSS and HTML that webmail clients already permit, attacker-controlled email content can reach across that boundary and manipulate the trusted interface itself.
Two Ways In
PortSwigger researcher Gareth Heyes describes two general approaches. The first simply abuses HTML and CSS features that webmail providers already allow inside messages, pushing them further than intended. The second exploits a mismatch between what a sanitizer thinks it approved and what the browser or application actually renders — a gap wide enough to smuggle unintended behavior through.
Outlook: Fake Sign-In Prompts
Outlook's handling illustrates how small allowances compound into serious risk. Label elements permitted inside a message can be used to trigger controls that live outside the message boundary, while the application's own JavaScript can convert sanitized custom attributes into new DOM nodes carrying attacker-supplied CSS. Chained together, researchers showed this can spoof Microsoft sign-in prompts convincingly enough to capture a victim's password directly inside what looks like a legitimate Outlook security-code screen.
Gmail, Fastmail, and Beyond
Gmail wasn't spared either. The research demonstrates that the CSS image-set() property can be abused to trigger external network requests originating from malicious email content, a technique with implications for tracking and further exploitation. Similar boundary-crossing issues were documented across Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, with impacts ranging from token leakage to hijacking of trusted UI actions and interference with AI tools that read and act on email content.
"Attackers don't need a link, a macro, or a download — just an email that looks like it belongs, sitting inside an interface users are trained to trust."
Not All Doors Stayed Open
The disclosure process shows this isn't a static threat. A Proton Mail proxy-bypass vector described in the research reportedly no longer works when retested, indicating the vendor patched the issue after being notified. Other techniques across the affected providers remain exploitable at time of reporting, underscoring that webmail hardening against message-boundary attacks is an uneven, ongoing effort rather than a solved problem.
The research reframes webmail security as a UI problem as much as a content-filtering one — sanitizing HTML tags isn't enough if the surviving CSS can still reach into the trusted chrome around it. Expect providers to keep patching individual vectors as PortSwigger and others report them, but the underlying tension between rich email formatting and airtight interface isolation isn't going away soon. Until it does, a suspiciously well-timed 'sign-in' prompt inside your inbox deserves the same suspicion as a link in a phishing email.
Editorial Note
The research sources consistently corroborate all major claims in the article: the Black Hat 2026 presentation by Gareth Heyes, the six affected webmail providers, the specific attack techniques (label elements in Outlook, image-set() in Gmail), and the range of impacts. Source 3 provides additional detail that some vulnerabilities were partially remediated (Proton Mail proxy-bypass). The article accurately reflects the technical findings without material distortion.
Claim Tracker
AI-assessed
Source 3 (Mallory) confirms 'Gareth Heyes presented the CSS-based webmail attack research at Black Hat USA 2026.'
Source 2 (Reg4Tech) explicitly lists all six webmail providers as affected in attack chains.
Source 2 (Reg4Tech) lists identical impacts: 'capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email.'
Source 1 (The Hacker News) confirms this technique: 'Gmail image-set() can trigger external requests from malicious email.'
Source 3 (Mallory) states: 'The research reported that a Proton Mail proxy-bypass technique no longer works on retest.'
Ask AI about this story
// discussion
sign in to join the discussion