CSS attacks on major webmail services can steal credentials, hijack sessions and manipulate AI tools connected to users’ inboxes.PortSwigger researcher Gareth Heyes demonstrated something that should make every webmail team a little nervous: plain CSS, the styling language that’s supposed to just make text look nice, can be weaponized to steal passwords, hijack sessions, and manipulate AI tools reading your inbox. The research covers real attack chains against Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.The core idea is that email clients let HTML and CSS through with the assumption that styling can’t reach outside the message it’s attached to. Heyes found ways to break that assumption using two basic approaches: abusing CSS features webmail already permits, or exploiting a gap between what a content sanitizer thinks it approved and what the browser actually renders. Either route can let content inside an untrusted email interact with the trusted interface surrounding it.“It’s quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization.” Heyes explains. “I looked at the various “allow listed” CSS properties and HTML. With the goal of abusing them to spoof UI actions, control browsers, take over accounts or steal tokens. I targeted Fastmail, OpenAI’s Atlas, Firefox, AOL Mail, Yahoo Mail and Outlook.”The Outlook chain is the most alarming one to picture in action. Allowed label elements can trigger controls that live outside the email itself, and Outlook’s own JavaScript can turn sanitized custom attributes into new page elements carrying CSS that bypasses the sanitizer’s rules entirely. Heyes used this to disguise a dropdown menu as a password field, and because Firefox resets its roughly one-second selection timer whenever that dropdown moves offscreen, the attack captures whatever the victim types in something close to real time.“A CSS gadget occurs when some existing JavaScript appends an element to the DOM with a CSS property or value outside the webmail CSS sanitizer allow list. We can use this to break out of trust boundaries.” continues the report.“This is a real CSS gadget that I found on Outlook. Here Outlook “allow lists” custom data attributes. One of the libraries they use appends to the DOM with an element and CSS property value outside their allow list. In this case position:fixed which allows you to position an element anywhere on the page. Which breaks the trust boundaries of an email message. We can then use this gadget to break out of the message window and deface Outlook.”Yahoo Mail and AOL Mail opened a different door, one involving something as mundane as copy and paste. In Firefox, HTML pasted into a draft can briefly keep its active styling before sanitization strips it out, and Heyes used that gap to leak a 12-character login token during a Medium sign-in flow, enough for an attacker’s server to reconstruct the token and log in as the victim.“They have a login via email feature that produces a 12 character hex token. If you can obtain this token then you can login as the user. An attacker can just initiate this process with the victim’s email then create some CSS to copy to the clipboard, the victim then only needs to paste into a draft and then their token is stolen.” the researcher explains.There’s also a clever workaround for cases where Content Security Policy blocks external resource requests entirely. Given the ability to inject styles and a numeric token displayed as plain text in an email, CSS alone can determine which digits appear and how often, then arrange links so a single click reveals that information to an attacker’s server. No JavaScript required, just careful use of selectors and visibility rules.The AI-connected piece of this research is where things get genuinely unsettling. Gmail’s image-set() fallback could trigger an external request despite sanitization, and Heyes chained that into an indirect prompt-injection email processed by Anthropic’s Claude Cowork through a connected Gmail integration. The injected instructions caused it to retrieve the token and place it in an HTML draft; viewing the draft leaked it, exactly the kind of AI-agent trap that turns a normal “summarize my inbox” request into unintended data exposure. A separate demonstration against OpenAI’s Atlas browser used hidden CSS pseudo-elements to show a human harmless text while an AI model read a completely different, hidden instruction underneath.Not every provider is equally exposed right now. Fastmail patched two CSS mutation bugs Heyes reported, and a Proton Mail proxy bypass stopped working when he retested it before publication. Outlook’s label-jacking trick and Gmail’s image-set() bypass, on the other hand, both still worked as of August 6, and the paper doesn’t confirm whether the full Outlook password-capture chain has been fixed at all.Heyes and PortSwigger published proof-of-concept code publicly alongside the research, and their guidance for webmail providers is fairly specific: isolate HTML email inside sandboxed iframes, restrict CSS to strict character allow-lists, check for dangerous CSS gadgets before permitting custom attributes, and block image requests to anything outside an approved domain list. None of that is exotic advice, but it does mean rethinking how much trust gets extended to something as apparently harmless as a stylesheet.Follow me on Twitter: @securityaffairs and Facebook and MastodonPierluigi Paganini(SecurityAffairs – hacking, CSS Attacks)