CSS-Based Webmail UI Manipulation Attacks (Credential and Token Theft via Style Injection)
First seen Aug 9, 2026 · Updated Aug 9, 2026
PortSwigger researcher Gareth disclosed a class of CSS-based attacks that allow content embedded in an email to escape its intended message boundary and manipulate the surrounding webmail interface. Affecting Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, hijack trusted UI elements, leak session tokens, take over third-party accounts, and manipulate AI tools that process email content.
Technical Analysis
The attack abuses CSS scoping and rendering weaknesses in webmail clients, allowing attacker-controlled style rules within an HTML email to break out of the sandboxed message body and interfere with surrounding trusted UI elements (e.g., login prompts, buttons, or notification banners). This enables UI redress and clickjacking-style attacks that trick users into submitting credentials or authorizing actions they did not intend, as well as exfiltration of OAuth tokens or session identifiers rendered in the DOM. No CVE has been assigned as this is disclosed as a cross-vendor design/implementation flaw class rather than a single software vulnerability. Because many AI agent and RAG pipelines ingest raw email content (including HTML/CSS) for summarization, triage, or automated response generation, maliciously crafted CSS could manipulate what an AI reader perceives or extracts, potentially causing prompt injection, data leakage, or incorrect autonomous actions based on visually or structurally spoofed email content.
Affected Systems
Webmail interfaces including Microsoft Outlook (web), Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail; any email client or AI-based email processing tool that renders or parses HTML/CSS content without strict sandboxing
Indicators of Compromise
- No specific file hashes, IPs, or domains published; attack relies on maliciously crafted HTML/CSS payloads embedded in email bodies
Remediation Steps
- 1
Sanitize HTML/CSS in Email Rendering
Strictly sandbox email body rendering using iframes with restrictive CSP and disallow CSS properties that can affect layout outside the message container.
- 2
Patch and Monitor Vendor Advisories
Apply security updates from Microsoft, Google, Fastmail, Proton, Yahoo, and AOL as they release fixes for the disclosed CSS escape techniques.
- 3
Harden AI Email Processing Pipelines
Strip or neutralize CSS/HTML styling before passing email content to LLM-based summarization, triage, or RAG systems to prevent prompt injection or spoofed content extraction.
- 4
Enforce Multi-Factor Authentication
Require MFA and short-lived tokens to reduce the impact of credential or token theft resulting from UI manipulation.
- 5
User Awareness Training
Educate users to be cautious of unexpected login prompts or UI changes when viewing emails, especially from external senders.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.