Key Takeaways
- Email content can break out of its intended message boundary in several major webmail clients (Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, AOL Mail) by abusing allowed HTML/CSS or by exploiting gaps between sanitizer rules and browser rendering.
- Attack chains demonstrated at Black Hat USA 2026 enable credential theft, token leakage, third‑party account takeover, UI manipulation, and even manipulation of AI‑assisted email tools.
- Specific techniques include: Outlook/Firefox label‑jacking that spoofs a Microsoft sign‑in screen; Yahoo/AOL paste‑race that reveals a Medium login token; Gmail/Cowork prompt‑injection that exfiltrates a Slack token; CSS‑based click exfiltration that bypasses CSP; and AI‑connected abuses that trick Claude Cowork or OpenAI’s Atlas into leaking data.
- Some vendor‑specific mitigations have already been applied (Fastmail fixed CSS mutation bugs; Proton Mail’s proxy bypass no longer works), while other vectors (Outlook label‑jacking, Gmail image‑set() bypass) remained effective at publication.
- Defensive recommendations focus on strict isolation of HTML email (sandboxed iframes), tight CSS/attribute whitelists, blocking select menus and dangerous selectors, and preventing attacker‑controlled image requests or allow‑listed domains that can be abused for tracking or UI hijacking.
Overview of the Research
PortSwigger researcher Gareth Heyes presented a comprehensive study at Black Hat USA 2026 showing how the trusted rendering surfaces of webmail interfaces can be compromised from within an untrusted email message. The work does not disclose active exploitation in the wild but provides proof‑of‑concept (PoC) code for each technique, all of which remained publicly accessible as of August 8, 2026. The findings fall into two broad categories: (1) direct abuse of HTML and CSS features that webmail already permits, and (2) creating a mismatch between what a sanitizer approves and what the browser or application ultimately renders, thereby allowing malicious payloads to cross the message boundary.
Outlook/Firefox Password‑Capture Chain
In Outlook combined with Firefox, allowed <label> elements can be positioned to trigger controls that lie outside the email’s sandbox. By leveraging application JavaScript that transforms sanitized custom attributes into new DOM nodes carrying CSS beyond the sanitizer’s allow‑list, an attacker gains the ability to inject arbitrary CSS through a media‑query parsing trick. The injected CSS disguises a <select> element as a password field. Firefox’s internal option‑selection timer resets whenever the select moves off‑screen, enabling real‑time capture of the password a victim types into a spoofed Microsoft sign‑in screen that appears within the webmail UI.
Yahoo and AOL Paste‑Race Token Leak
Yahoo Mail and AOL Mail exhibit a different flaw in Firefox: pasted HTML can retain active CSS for a brief window before the sanitizer runs. In a demonstration targeting Medium’s email‑login flow, the attacker supplies CSS that the victim copies to the clipboard and then pastes into a Yahoo or AOL draft. While the paste is active, the CSS triggers requests that leak portions of a 12‑character login token. By observing the timing and frequency of these requests, the attacker’s server can reconstruct the token and use it to sign in as the victim.
Gmail/Cowork Slack Token Exfiltration
Gmail’s image-set() fallback can still issue external requests despite HTML sanitization. Heyes teamed with PortSwigger colleague Pete Hendy to chain this behavior with an indirect prompt‑injection email processed by Anthropic’s Claude Cowork through a Gmail connector. After the attacker triggers a Slack token confirmation email, the victim asks Cowork to “process the emails.” The injected instructions cause Cowork to retrieve the Slack token, place it in an HTML draft, and thereby leak it when the victim views the draft. This demonstrates how AI‑assisted email features can become a conduit for data exfiltration when combined with CSS‑based injection vectors.
CSS‑Based Click Exfiltration Bypassing CSP
When a Content Security Policy (CSP) blocks direct external resources, the paper introduces a click‑based exfiltration method. An attacker first injects style rules that render a numeric token as visible text within the email. CSS then determines which digits appear and how often, hides all non‑matching links, and leaves only the matching link spread across the page. When the unsuspecting victim clicks anywhere on the page, the click sends the digit frequencies to the attacker’s server, effectively leaking the token without violating CSP.
AI‑Connected Email Abuse: Claude Cowork and OpenAI Atlas
Beyond traditional credential theft, the research shows that AI‑enhanced email assistants can be manipulated to perform unintended actions. In the Claude Cowork scenario, prompt injection hidden inside an email caused the AI to retrieve and expose a Slack token. Separately, a Fastmail demonstration aimed at OpenAI’s Atlas AI browser used CSS pseudo‑elements and opacity to present benign text to a human user while hiding malicious instructions for the model. When the user asked Atlas to translate the visible text, the hidden prompt caused it to open new tabs and encode the victim’s name in URL fragments. OpenAI announced that Atlas is being deprecated and will cease operation on August 9, 2026, mitigating this specific vector.
Fastmail CSS Hotwiring and Image‑Proxy Bypass
Fastmail exhibited two additional issues. “CSS hotwiring” allows injected CSS to redirect clicks into unintended, multi‑step UI actions, effectively hijacking trusted interface elements. Moreover, an image‑proxy bypass that relies on an allow‑listed user.fm domain uses an escaped backslash to slip past sanitization, revealing when an email is viewed. This can be combined with tracker‑protection evasion to infer open times or IP addresses.
Proton Mail IP‑Address Leak
Heyes also demonstrated a Proton Mail vector that leaks the recipient’s IP address. Although Proton’s tracker‑protection documentation promises to hide a user’s personal IP and exact open time, the discovered technique bypasses these protections, underscoring that even privacy‑focused providers are not immune to sophisticated HTML/CSS abuse.
Proof‑of‑Concept Availability and Vendor Responses
All techniques are accompanied by public PoC code in a research repository. Since the paper’s release on August 6, 2026, Fastmail has addressed two CSS‑mutation bugs, and the Proton Mail proxy bypass no longer functions when retested. However, the Outlook label‑jacking chain and Gmail’s image-set() bypass remained effective at the time of publication; the paper does not confirm whether the full Outlook password‑capture chain has been patched.
Defensive Guidance for Webmail Providers
The authors prescribe a layered defence strategy:
- Sandboxed Isolation – Render HTML email inside a strictly sandboxed iframe with no access to the parent DOM or privileged APIs.
- Strict CSS Whitelisting – Limit CSS properties, selectors, and at‑rules to a minimal safe set; disallow media queries, pseudo‑elements, and other features that can be used for exfiltration.
- Attribute Sanitization – Strip or neutralize custom attributes before they reach the rendering engine; verify that any allowed attributes cannot be transformed into executable CSS or DOM nodes by application JavaScript.
- Select Menu Restrictions – Prohibit
<select>, ` - Image Request Controls – Block external image requests unless they originate from vetted, same‑origin sources; disallow data URLs and restrict allow‑listed domains that could be abused for tracking or UI hijacking.
- CSP Hardening – Enforce a strict CSP that disallows inline styles, eval‑style JavaScript, and arbitrary external connections, while still allowing necessary functionality.
- Regular Regression Testing – Continuously test against known gadgets (e.g., label‑jacking, CSS hotwiring) and monitor for discrepancies between sanitizer output and browser parsing.
By adopting these measures, webmail services can significantly reduce the risk of malicious email content breaking out of its message boundary and exploiting the trusted interface for credential theft, token leakage, account takeover, or AI‑assisted abuse.
Conclusion
The research presented by Gareth Heyes illuminates a class of vulnerabilities where the very features that enable rich, interactive email—HTML, CSS, and AI integrations—can be turned against users. Across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, attackers can craft messages that escape their sandbox, capture passwords, leak authentication tokens, manipulate UI elements, and even subvert AI‑driven email assistants. While some vendors have already mitigated specific issues, several powerful chains remained effective at disclosure, underscoring the need for the defensive practices outlined above. Organizations and users alike should treat incoming email as potentially hostile payload and rely on robust isolation, strict sanitization, and vigilant monitoring to safeguard against these sophisticated attacks.