New research reveals how malicious styles slip through email boundaries and hijack webmail interfaces
Researchers have discovered that carefully crafted CSS can escape an email’s content boundary and manipulate the webmail UI, enabling attackers to capture credentials, hijack third‑party accounts, and leak tokens across major providers.
A new study released by PortSwigger shows that malicious CSS embedded in an email can slip past the message boundary and interfere with the webmail interface.
The technique relies on CSS selectors that target elements outside the email body, allowing styles to be injected into the surrounding page.
Because most webmail clients render the email content within an iframe or a sandboxed container, the injected styles can still affect the parent document if the client’s security model is not strict.
Researchers tested the attack on Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, demonstrating that the same pattern works across a broad range of providers.
Once the style is applied, the attacker can use CSS tricks such as :focus-within and :hover to trick the user into entering a password into a hidden field that is then read by the page’s JavaScript.
The stolen credential can be sent to an external server, giving the attacker access to the victim’s third‑party accounts that are linked to the webmail service.
In addition to passwords, the attack can leak session tokens that are stored in the page’s memory, allowing the attacker to hijack the current session without needing the user’s credentials.
The injected styles also allow the attacker to hijack trusted UI actions such as clicking the ‘Send’ button or changing account settings, making it appear as if the user performed those actions.
Researchers noted that the same CSS can manipulate email‑reading tools that parse message content, potentially exposing sensitive data to downstream applications.
Webmail providers should enforce stricter content‑security policies and sandboxing mechanisms to prevent CSS from leaking outside the email body. Users are advised to keep their software updated and to be cautious when interacting with unfamiliar email content.
A new study released by PortSwigger shows that malicious CSS embedded in an email can slip past the message boundary and interfere with the webmail interface.
The technique relies on CSS selectors that target elements outside the email body, allowing styles to be injected into the surrounding page.
Because most webmail clients render the email content within an iframe or a sandboxed container, the injected styles can still affect the parent document if the client’s security model is not strict.
Researchers tested the attack on Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, demonstrating that the same pattern works across a broad range of providers.
Once the style is applied, the attacker can use CSS tricks such as :focus-within and :hover to trick the user into entering a password into a hidden field that is then read by the page’s JavaScript.
The stolen credential can be sent to an external server, giving the attacker access to the victim’s third‑party accounts that are linked to the webmail service.
In addition to passwords, the attack can leak session tokens that are stored in the page’s memory, allowing the attacker to hijack the current session without needing the user’s credentials.
The injected styles also allow the attacker to hijack trusted UI actions such as clicking the ‘Send’ button or changing account settings, making it appear as if the user performed those actions.
Researchers noted that the same CSS can manipulate email‑reading tools that parse message content, potentially exposing sensitive data to downstream applications.
Webmail providers should enforce stricter content‑security policies and sandboxing mechanisms to prevent CSS from leaking outside the email body. Users are advised to keep their software updated and to be cautious when interacting with unfamiliar email content.