Researcher Gareth Heyes from PortSwigger presented at Black Hat USA 2026 a study demonstrating how the contents of an email can escape the boundaries of the message and interact with the webmail interface. According to the research, the attack chains affect Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail and allow attackers to intercept passwords, steal third-party service authorization tokens, spoof elements of the trusted interface, and manipulate AI tools that process email. Public PoC materials are available on GitHub. No malicious exploitation in real-world attacks has been recorded — these are proofs of concept.
Two attack vectors: allowed code and sanitization discrepancies
According to the published research, the attacks follow two fundamental paths. The first is abusing HTML and CSS constructs that webmail already allows. The second is creating a discrepancy between what the sanitizer approves and what the browser or application ultimately renders. Both approaches let untrusted email content influence the trusted interface.
Outlook and Firefox: password theft via fake login screen
The most illustrative chain is demonstrated for Outlook in combination with Firefox. According to the researcher, permitted label elements can activate controls outside the email, and the application’s JavaScript transforms sanitized user attributes into new DOM nodes with CSS that goes beyond the allowed list. A trick involving parsing media queries gives the attacker arbitrary CSS.
The chain disguises a select element as a password input field. A particular Firefox behavior — resetting the roughly one-second option selection timer when the element moves off-screen — makes the interception of typed characters effectively real-time. The victim sees a fake Microsoft login screen and enters a password, which is sent to the attacker. As of the publication date of the research on 6 August, the “label-jacking” technique in Outlook was reportedly still working. The status of a fix for the full password-stealing chain is not specified in the research.
Yahoo Mail and AOL Mail: token leakage via clipboard
For Yahoo Mail and AOL Mail, a different vector is described. In Firefox, HTML pasted from the clipboard briefly retains active CSS until sanitization fires. In a demonstration using the Medium service, the attacker initiates an email-based login procedure, the victim copies attacker-prepared CSS to the clipboard and pastes it into a Yahoo or AOL draft. The resulting HTTP requests reveal enough characters of the 12-digit login token for it to be reconstructed on the attacker’s server and then used to log in as the victim.
CSP bypass: click-based exfiltration
For cases where Content Security Policy blocks external resources, the research presents a click-based exfiltration technique. When style injection exists and a numeric token is present in the email text, CSS determines which digits appear and how often, hides non-matching links, and leaves only the matching one visible. The victim’s click sends the digits and their frequency to the attacker’s server.
AI tools as a new attack surface
A separate class of attacks is related to AI systems connected to email. An image-set() bypass in Gmail made it possible to perform an external request despite sanitization. Heyes, together with colleague Pete Hendy, tied this to an indirect prompt injection in an email processed by Claude Cowork from Anthropic via the Gmail connector.
In the demonstration, the attacker initiated sending an email with a Slack confirmation token. When the victim asked Cowork to process incoming mail, the injected instructions forced the AI to extract the token and place it into an HTML draft. Viewing the draft led to the token being leaked. As of the publication date, the image-set() bypass in Gmail was reportedly still working.
Another demonstration targets OpenAI Atlas, an AI browser. CSS pseudo-elements and transparency allowed a human to see harmless text while the model read hidden instructions. When the user requested a translation of the visible text, the hidden prompt made Atlas open tabs and encode the victim’s name in URL fragments. OpenAI is discontinuing Atlas — the service was scheduled to stop working on 9 August 2026.
Fix status and affected products
According to the researcher, providers’ responses vary:
- Fastmail — two CSS mutation bugs have been fixed
- Proton Mail — the proxy bypass stopped working on retest; at the same time, a vector for disclosing the recipient’s IP address was demonstrated, contradicting Proton’s documentation on tracker protection
- Outlook — the label-jacking technique was still working as of the publication date
- Gmail — the
image-set()bypass was still working as of the publication date - Yahoo Mail / AOL Mail — fix status not specified
Important: all statements about vulnerability status are based on data from a single researcher. No official security advisories from Microsoft, Google, Yahoo or other vendors were found in publicly available sources.
Impact assessment
Taken together, the affected platforms cover the overwhelming majority of webmail users. Organizations that use AI integrations with mail services — Claude Cowork connectors, automated processing of incoming messages and similar solutions — are at greatest risk. Although the attack chains require user interaction, they exploit familiar actions: entering a password on a familiar screen, pasting text from the clipboard, clicking a link in an email, or sending a request to an AI assistant.
Disclosure of IP addresses poses a separate threat to Proton Mail users who choose this service specifically for its privacy.
Protection recommendations
The research includes specific recommendations for webmail providers:
- Isolation — render HTML emails in isolated (sandboxed) iframes
- Strict CSS validation — use allowlists of permitted characters instead of blocking only known dangerous constructs
- Review CSS gadgets — audit user attributes for the ability to generate new DOM nodes
- Block select elements and dangerous CSS selectors in the email context
- Control image requests — prevent requests to attacker-controlled external resources, including domains from allowlists
For end users: avoid pasting clipboard content into webmail drafts, do not enter credentials on login screens that appear inside the mail client interface, and be cautious when using AI assistants for automatic processing of incoming email — especially if your mailbox may contain messages from unknown senders.
Webmail providers should audit their HTML/CSS sanitizers in light of the published PoC materials from the research repository, paying particular attention to discrepancies between sanitization results and final rendering in different browsers. Organizations using AI mail connectors are advised to assess the risks of indirect prompt injection via incoming messages and, if necessary, restrict automatic AI access to untrusted emails.
