Security researchers have demonstrated a new class of attacks showing how something as ordinary as the formatting inside an email can potentially interfere with the webmail service displaying it.
The research covers major services including Microsoft Outlook, Gmail, Proton Mail, Fastmail, Yahoo Mail and AOL Mail, with proof-of-concept attacks demonstrating techniques that could expose passwords or authentication tokens, hijack trusted interface actions and even manipulate AI tools connected to an inbox.
What makes the research particularly interesting is that an attacker doesn’t necessarily need traditional malware or JavaScript running inside the email.
Instead, the attacks abuse HTML, CSS and quirks in how webmail applications process messages.
Before you panic, however, there’s an important distinction: these are security-research demonstrations, not evidence that attackers are currently using all of these techniques against webmail users in the wild.
Here’s what researchers discovered.
Attack #1: Making a Malicious Email Escape Its Boundaries
Webmail services have a difficult security problem.
They need to display richly formatted emails containing HTML and CSS while preventing the person who sent the email from controlling anything outside the message itself.
Normally, sanitisation systems strip potentially dangerous content before an email is displayed.
Research presented by PortSwigger’s Gareth Heyes at Black Hat USA 2026 demonstrates ways those boundaries can break down.
One of the most striking examples involved Outlook.
The researchers found that HTML and CSS allowed inside a message could be combined with behaviours in the surrounding web application. In a demonstrated attack chain involving Outlook and Firefox, this could be used to create what appeared to be a Microsoft sign-in interface.
A victim could then be tricked into entering a password into the fake interface.
The crucial point is that the fraudulent prompt could appear within an environment the user already trusts: their webmail.
That potentially makes the attack more convincing than a conventional phishing website hosted on an obviously suspicious domain.
Attack #2: Stealing Tokens and Manipulating Trusted Actions
The second broad category demonstrated by the research involves using CSS and browser behaviour to reveal information or interfere with actions outside the malicious email itself.
Authentication tokens are particularly valuable because websites sometimes use them to confirm a login without requiring a conventional password.
Researchers demonstrated one attack involving Yahoo Mail and AOL Mail in Firefox where specially crafted CSS and clipboard behaviour could help expose a login token sent by Medium.
If reconstructed successfully, that token could potentially allow an attacker to sign in as the victim.
Other demonstrations showed how CSS could manipulate trusted user-interface actions or leak information through carefully constructed external requests.
That means the security issue isn’t simply about making an email look deceptive.
It’s about whether untrusted email content can influence the trusted application surrounding it.
Gmail Was Part of an AI-Related Attack Chain
One of the more unusual demonstrations involved Gmail and an AI assistant.
Researchers found that Gmail’s handling of an image-set() CSS function could generate an external request under certain conditions.
That behaviour was then combined with indirect prompt injection in a demonstration involving an AI assistant connected to Gmail.
In the proof of concept, malicious instructions contained in an email influenced the AI system into processing information in an unintended way. The attack chain ultimately demonstrated how a Slack authentication token could be placed into an HTML draft and leaked when that draft was viewed.
This required a specific sequence of conditions and user interaction, so it shouldn’t be interpreted as meaning that simply receiving an email gives an attacker access to your Slack account.
But it highlights an emerging security problem.
AI assistants increasingly have permission to read email, calendars, documents and other private information. A malicious message isn’t necessarily targeting only the person reading it anymore.
It may also be targeting the AI agent that reads it.
Proton Mail and Fastmail Were Tested Too
Privacy-focused email providers weren’t immune to the broader class of techniques investigated by the researchers.
The research included tests involving both Proton Mail and Fastmail.
However, vulnerability status matters.
According to the researchers, Fastmail fixed two CSS mutation issues identified during the work.
A Proton Mail proxy bypass used in one demonstration reportedly no longer worked when it was tested again.
Meanwhile, some other techniques involving services such as Outlook and Gmail reportedly remained reproducible when the research was published.
Security research evolves quickly, so readers shouldn’t interpret a service appearing in the research as evidence that every demonstrated attack remains exploitable today.
Why CSS Can Be Dangerous
CSS is normally associated with harmless visual design.
It controls things such as:
- Fonts
- Colours
- Positioning
- Visibility
- Layout
- Images
- Responsive page behaviour
But modern CSS is surprisingly powerful.
Researchers can sometimes abuse selectors, external resource requests, positioning and other behaviours to infer information or manipulate what a user sees.
The danger becomes greater when CSS inside untrusted content can somehow affect elements outside the area where it is supposed to operate.
Think of an email as a guest staying in one room of a house.
The security model assumes that guest can rearrange furniture inside the room but can’t walk into the rest of the building and start moving things around.
The new research explores what can happen when those boundaries aren’t as solid as developers expect.
Does This Mean Gmail or Outlook Has Been Hacked?
No.
That’s an important distinction.
The researchers demonstrated weaknesses and attack chains under specific conditions. The research does not establish that Gmail, Outlook or Proton Mail accounts are currently being compromised at scale using these techniques.
Some demonstrations also depended on particular browsers, user actions, connected services or combinations of vulnerabilities.
Several reported weaknesses have already been addressed or changed.
The responsible takeaway isn’t “stop using webmail.”
It’s that rendering untrusted HTML email safely remains an extremely complicated security challenge.
What Can Regular Users Do?
Most of the fundamental fixes need to come from email providers rather than individual users.
Providers can strengthen isolation between an email and the surrounding application, tighten restrictions on CSS and HTML, and carefully control external requests generated by message content.
There are still useful precautions users can take.
Be suspicious whenever an email asks you to enter a password, even if the prompt appears to be part of a familiar service.
Rather than entering credentials through something presented inside a message, open the relevant website or account settings separately.
Users should also:
- Keep browsers updated.
- Enable multi-factor authentication where possible.
- Avoid entering passwords into forms embedded in emails.
- Be cautious about granting AI assistants broad access to email and other accounts.
- Review unusual login notifications immediately.
Those habits protect against far more than this particular research.
AI Makes Email Security More Complicated
Perhaps the biggest long-term takeaway isn’t CSS at all.
It’s AI.
An email was traditionally designed to communicate with a human.
Now an email might also be read, summarised and acted upon by an AI assistant with access to other services.
That introduces an entirely new attack surface.
A malicious instruction that looks meaningless or invisible to a human might still influence an AI agent processing the message.
Security companies and AI developers are already investigating prompt-injection attacks for precisely this reason.
As assistants become capable of taking actions rather than merely answering questions, protecting them from malicious content will become increasingly important.
Final Thoughts
Email has existed for decades, but securing modern webmail is becoming more complicated rather than less.
Today’s inboxes aren’t simple message viewers. They’re sophisticated web applications connected to cloud storage, productivity suites, authentication systems and increasingly AI assistants.
The research presented at Black Hat USA 2026 demonstrates how seemingly harmless HTML and CSS can sometimes be combined with application and browser behaviour in unexpected ways.
For Gmail, Outlook, Proton Mail and other providers, the lesson is clear: the boundary between an untrusted email and the trusted interface surrounding it needs to be extremely difficult to cross.
For everyday users, the advice is simpler.
Never trust a password prompt just because it appears somewhere that looks familiar.
By Radoslav Jokic
Updated on 8th August 2026