Summary
- New research shows email content can break out of its message boundary and interfere with the wider webmail UI.
- Affected platforms include Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.
- Attack chains demonstrated include password capture, session token leakage, account takeover, and UI hijacking.
- AI tools that process email content are also identified as a potential vector.
- The research was conducted by Gareth Heyes at PortSwigger.
The core problem
Webmail clients have long operated on an implicit assumption: that the content of a message stays within its own rendering boundary and cannot reach out to touch the broader application interface. New research by PortSwigger’s Gareth Heyes challenges that assumption directly. By crafting malicious CSS within an email, Heyes demonstrated that content can escape the message container and interact with the surrounding webmail UI in ways the application does not anticipate or defend against.
Scope of affected platforms
The research covers attack chains against six widely used webmail services: Microsoft Outlook, Google Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. The breadth of that list is notable. These are not obscure or legacy platforms — they collectively serve hundreds of millions of users, including a significant proportion of enterprise and government staff who access corporate or personal email through web interfaces.
What the attacks can achieve
The demonstrated impact is varied and serious. According to the research summary, successful exploitation of these techniques can result in password capture, takeover of third-party accounts linked to the webmail service, leakage of session tokens, hijacking of trusted UI actions, and manipulation of AI tools that read or summarise email content. Each of those outcomes represents a distinct risk category. Token leakage, for instance, can persist beyond a single session, while UI hijacking could be used to trick a user into authorising an action they did not intend.
CSS as an attack surface
Cascading Style Sheets are not typically considered a high-risk attack surface in the way that JavaScript or HTML injection are. Webmail clients routinely strip or sandbox script execution, but CSS handling is a less scrutinised layer of the rendering pipeline. This research appears to demonstrate that CSS properties — when applied in particular combinations or contexts — can influence elements outside the email body itself, effectively blurring the line between message content and application chrome. The precise technical mechanisms have not been fully detailed in the available source material beyond this summary.
AI integration adds a new dimension
The inclusion of AI tools as a potential target is worth specific attention for security leaders. Many organisations are now deploying or permitting the use of AI-assisted email features — summarisation, prioritisation, suggested replies — that process raw message content. If adversarial CSS can influence how those tools behave or what they surface to a user, that represents an emerging attack surface that sits outside the traditional threat model for email security. The research flags this as a concern, though the source material does not detail specific AI products or exploit chains.
What is not yet known
The available source material is a research summary rather than a full technical disclosure. The specific CVE identifiers, patch status for each affected provider, and the precise CSS mechanisms involved are not confirmed in the material provided. It is not known at this stage whether any of the identified vulnerabilities have been exploited in the wild, or what remediation commitments the affected vendors have made.
Why it matters
For CISOs, this research reframes webmail from a relatively contained risk into a potential pivot point. Organisations that have invested in perimeter email filtering and malware scanning may have less visibility into CSS-layer attacks that do not rely on attachments or links. Users accessing webmail through browsers — including executives on personal devices or via cloud productivity suites — may be exposed in ways that endpoint controls do not address. The involvement of AI email tools broadens the attack surface further, particularly for organisations that have enabled third-party AI integrations with corporate mailboxes. Until vendor patches are confirmed and applied, the practical control options are limited, which makes awareness and monitoring especially important.
What to do now
- Monitor for advisories and patches from affected providers — Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail — and prioritise deployment once available.
- Review whether AI-assisted email tools are integrated with corporate mailboxes and assess what content those tools can access and act upon.
- Consider whether webmail access policies for sensitive roles require tightening while the full scope of these vulnerabilities is understood.
- Ensure security awareness communications inform staff that malicious emails can potentially affect the webmail interface itself, not just deliver malicious links or attachments.
