CSS webmail attacks steal passwords, tokens, data

New CSS-only attack chains against major webmail services show that content inside an HTML email can escape its message boundary and tamper with the surrounding interface, enabling theft of passwords, login tokens and other sensitive data across multiple providers.^[1][8][12] In a series of proof-of-concept exploits, researchers demonstrated that carefully crafted style rules are enough to cross from untrusted message content into trusted webmail UI elements, despite sanitization layers designed to keep them separate.^[1][6][12] The techniques work against popular platforms including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail and AOL Mail in various browser configurations, raising fresh concerns about how deeply email clients can safely render HTML and CSS.^{[1][2][8][12]}

The work, led by PortSwigger researcher Gareth Heyes and detailed in a study titled “CSS: the bomb inside your inbox,” shows that CSS alone—without JavaScript or file attachments—can be weaponized to read user input, leak tokens and hijack account flows.^[4][12] One attack chain targeting Outlook in Firefox builds a fake Microsoft sign-in screen inside the webmail interface and uses CSS-driven overlays to capture the password the victim types, turning a routine login into a stealth credential theft.^[1][12] Other chains re-style and repurpose existing buttons and menu items so that when a user clicks what appears to be a benign action, the underlying request instead performs an attacker-controlled operation with the victim’s session.^[1][6][12] The research also shows how CSS-defined pseudo-elements and near-invisible text can manipulate AI-powered email assistants, causing tools such as an integrated OpenAI-based agent to follow hidden instructions that differ from what the human recipient sees on screen.^[2][12][15]

Under the hood, the attack paths fall into two broad categories: abusing HTML and CSS that webmail clients already permit, and exploiting discrepancies between what a sanitizer allows and what the browser ultimately renders.^[1][12][14] By probing which properties and selectors survive each provider’s filters and then iteratively mutating payloads, the researcher identifies “CSS gadgets”—fragments of permitted styling that can be chained to leak data, keylog keystrokes or drive state changes in the surrounding interface.^[6][12][15] Some payloads rely on advanced selectors and functions such as attribute-based matching combined with image-loading properties, so that the presence of particular characters in an input field or token causes the browser to fire distinct external image requests that encode the secret value.^[6][12] In another proof of concept, a victim copying attacker-supplied HTML from one email and pasting it into a Yahoo or AOL draft inadvertently preserves active CSS long enough for it to exfiltrate a 12-character login token via outbound requests, allowing the attacker to reconstruct and reuse it to sign in as the victim.^[1]

The findings land in a broader context in which email clients have repeatedly struggled to safely handle CSS and rich content. Recent flaws in the Roundcube webmail software, including CVE-2024-42010, involved insufficiently filtered CSS token sequences in rendered messages that could be abused to obtain sensitive information, illustrating how styling languages can double as data exfiltration channels when sanitization falls short.^[5] Other campaigns, such as a Zimbra zero-click stored cross-site scripting bug tracked as CVE-2025-66376, have used CSS constructs like @import to bypass client-side filters and execute attacker-controlled JavaScript when a malicious email is merely viewed in the web interface.^[3] In contrast, the new cross-webmail CSS chains are currently described as research-grade proofs of concept rather than techniques observed in criminal or state-backed intrusion campaigns, but they closely resemble real-world exploitation patterns seen in webmail-focused operations.^{[1][4][6][11][12]}

Defensive guidance from the research emphasizes strict isolation of untrusted email content as the most effective line of defense, starting with rendering HTML messages inside sandboxed iframes so that CSS cannot reach the surrounding application chrome.^[1][6][12] Webmail providers are urged to move from ad hoc blocklists toward tight allowlists for CSS syntax, to disable or heavily constrain complex selectors, custom attributes, select elements and image-based data exfiltration paths, and to carefully audit for reusable CSS gadgets in their DOM and component libraries.^{[1][6][12][14]} Organizations that rely on webmail gateways can reduce exposure by stripping or flattening complex HTML where possible, disabling remote image loading and favoring plain-text rendering for high-risk senders, particularly in environments where single sign-on or sensitive workflows run inside the same browser session.^[6][11][14] For end users, the research reinforces long-standing advice: treat HTML-heavy messages with caution, be wary of unexpected login prompts inside email tabs and avoid copying and pasting rich content from untrusted emails into drafts or other browser contexts, especially when using webmail.^[1][6][12]

References

1. New CSS Attacks Can Break Webmail Defenses to Steal Passwords …
2. CSS engana webmail e agentes, FreeBSD expõe root e o …
3. Zimbra Zero-click (CVE-2025-66376): Email & 2FA theft by LAUNDRY BEAR
4. CSS: The Hidden Threat Lurking in Your Inbox – daily.dev
5. Roundcube flaws allow easy email account compromise …
6. aHR0cHMlM0ElMkYlMkZ3d3cuZGFya3JlYWRpbmcuY29tJTJGY3liZXJhdHRhY2tzLWRhdGEtYnJlYWNoZXMlMkZjc3MtaGlkZGVuLXRocmVhdC1sdXJraW5nLWluYm94
8. Security-Portal.cz | Bezpečnost • Hacking • Komunita
11. Webmail services are under a barrage of XSS attacks. What SMBs …
12. CSS:the bomb inside your inbox | PortSwigger Research
14. WSTG – v4.1 | OWASP Foundation
15. Styled to Steal: The Overlooked Attack Surface in Email Clients