New CSS Attacks Break Webmail Isolation to Steal Passwords and Hijack AI Assistants

At Black Hat USA 2026, PortSwigger web security researcher Gareth Heyes delivered a groundbreaking presentation titled “CSS: The Bomb Inside Your Inbox,” exposing a critical vulnerability in modern email security architectures. For decades, cybersecurity teams have operated under the assumption that Cascading Style Sheets (CSS) represent a harmless presentation layer, while executable code like JavaScript poses the primary vector for client-side exploitation. Heyes dismantled this paradigm by demonstrating how sophisticated CSS attacks can completely break the isolation sandboxes of major webmail providers—including Microsoft Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail—without executing a single line of JavaScript or relying on malicious file attachments.

By exploiting subtle gaps between what webmail sanitizers consider safe and how browser layout engines evaluate Cascading Style Sheets, malicious actors can manipulate the surrounding trusted user interface (UI). These weaponized email payloads enable attackers to capture user passwords in real time, hijack session tokens, alter user actions through UI redressing, and manipulate integrated artificial intelligence (AI) assistants that process incoming inbox content. As web browsers continuously expand CSS capabilities with complex layout modules, selectors, and functional expressions, the attack surface expands alongside them, turning cosmetic email styling into a potent exploitation engine.

Understanding the Architecture: How CSS Attacks Break Webmail Isolation

The foundational security model of webmail platforms relies on rendering untrusted HTML and CSS inside a trusted application wrapper. Because users expect rich HTML emails complete with custom typography, brand colors, and responsive layouts, webmail vendors cannot simply block style tags or inline styles. Instead, platforms deploy complex CSS sanitizers designed to parse incoming styles, strip dangerous properties—such as position: fixed or behavior—and isolate the email body inside a designated container or sandboxed <iframe>.

However, Heyes revealed that these sanitization boundaries frequently fail due to CSSOM (CSS Object Model) mutation bugs, browser parsing discrepancies, and DOM hierarchy abuses. When a webmail sanitizer inspects raw markup, it validates rules based on static string matching or AST (Abstract Syntax Tree) sanitization. Yet, when the browser parses and renders that sanitized payload, subtle encoding transformations or browser-specific rendering quirks occur. For instance, Google Chrome automatically decodes escaped CSS characters during DOM readback, allowing an attacker to pass an innocent-looking rule through the sanitizer that mutates into a perimeter-breaking rule upon browser execution.

Furthermore, attackers can leverage allowed HTML elements in conjunction with CSS to bridge the gap between untrusted email content and the host application UI. By abusing native HTML <label> elements targeted at hidden form inputs outside the message container, or exploiting custom data attributes that host application JavaScript improperly converts into active DOM elements, attackers gain structural control over the surrounding page. Once an attacker achieves structural breaking, they can apply CSS layout properties like position: fixed to render malicious overlays over any part of the webmail interface.

Weaponized CSS Attacks: Real-Time Keylogging, UI Redressing, and CSSOM Mutation

The research unveiled several distinct exploit chains demonstrating that CSS alone possesses sufficient computational logic to execute complex, interactive attacks. By chaining CSS state selectors with visual properties, researchers created functional keylogging engines and credential harvesters directly inside the inbox.

The primary technical mechanisms driving these advanced CSS attacks include:

• Zero-JavaScript CSS Keylogging: In Microsoft Outlook rendered via Firefox, Heyes demonstrated a fully functional, real-time keylogger. By combining allowed HTML <label> elements, CSS gadgets that exploit custom data attributes to achieve position: fixed styling, and the -webkit-text-security property alongside HTML <select> element quirks, the attack spoofs an authentic Microsoft login prompt inside the mailbox UI. As the victim types their password into the fake prompt, CSS attribute selectors dynamically detect character matches and trigger external background HTTP requests for each typed character, exfiltrating credentials in real time without executing scripts.
• CSSOM Mutation and Sanitizer Bypasses: Demonstrated against Fastmail, this technique exploits discrepancies between the sanitizer’s validation pass and the browser’s final style tree creation. When CSS rules contain specific escaped characters, Chrome decodes those escapes during CSSOM mutation. This causes sanitized inline styles to expand into active selectors that escape the email body scope, allowing rules to target global UI elements.
• UI Redressing and “CSS Hotwiring”: Webmail interfaces often contain high-privilege buttons, such as “Forward All Mail,” “Account Settings,” or third-party OAuth permissions. Using HTML <label> jacking and CSS :before or :after pseudo-elements, attackers can construct invisible or misleading UI layers over legitimate buttons. “CSS Hotwiring” allows an attacker to intercept all clicks on the page, rerouting user interactions toward attacker-specified controls or triggering unintended privileged actions within the host application.

Exfiltrating Tokens and Bypassing Content Security Policies

A major challenge for client-side attacks is exfiltrating captured data when web application firewalls or strict Content Security Policies (CSP) block external network requests. Heyes demonstrated that Cascading Style Sheets offer multiple side-channel exfiltration mechanisms capable of bypassing traditional CSP directives and image proxy filters.

In Gmail, attackers leveraged the image-set() CSS function to bypass internal image proxies. While Gmail attempts to route all email images through secure Google proxy servers to protect user IP addresses, image-set() parsing flaws allowed crafted CSS rules to force the user’s browser to send direct, unproxied outbound HTTP requests to attacker-controlled infrastructure, leaking sensitive session metadata and tracking email views.

Even when strict CSP rules outright prohibit external HTTP requests, attackers can deploy font-height oracles and CSS keyframe animations to infer and exfiltrate secrets locally. By nesting CSS attribute selectors (such as input[value^="a"], input[value^="b"]), the stylesheet can systematically brute-force sensitive values—such as CSRF tokens or personal identification numbers—stored in hidden DOM elements. The CSS alters font dimensions based on matching characters, causing measurable layout shifts that can be read via side channels or exposed during subsequent clipboard paste events.

Furthermore, in platforms like Yahoo Mail and AOL Mail, researchers exposed a “paste race condition”. When a user copies and pastes content into an email draft, short-lived authentication tokens—such as 12-character hex tokens used by third-party services like Medium—can be captured and exfiltrated via injected CSS selectors before the webmail interface sanitizes the active draft buffer.

The New Threat Frontier: Hijacking AI Assistants via Email CSS

As major tech enterprise platforms integrate Generative AI tools and automated agents directly into the inbox experience—such as Gmail’s AI summarizers, Google Workspace Gemini, or browser-level AI agents like OpenAI’s Atlas browser—the blast radius of CSS injection attacks has expanded dramatically.

AI assistants process email markup to generate summaries, action items, or automated replies. Attackers can craft CSS using generated content properties (content: "...") inside :before and :after pseudo-elements that remain invisible to human readers but are parsed by AI text extractors and document processors. This enables indirect prompt injection delivered purely through CSS styling.

For example, an attacker can hide malicious prompt instructions inside CSS pseudo-elements. When an AI email assistant reads the message, it interprets the hidden CSS content as legitimate context, compelling the AI agent to execute unauthorized tasks—such as extracting confidential information from previous inbox threads, exfiltrating internal Slack authorization tokens (as demonstrated in Gmail/Cowork exploit chains), or fabricating false summaries to deceive the victim.

Defensive Mitigation: How Webmail Vendors and Enterprise Security Teams Must Respond

Mitigating modern CSS vulnerabilities requires a fundamental shift in how security engineering teams treat stylesheet parsing and DOM rendering. Treating CSS as benign visual markup is no longer viable. Webmail providers and enterprise application developers must implement defense-in-depth measures to isolate and sanitize style execution.

Key remediation strategies include:

1. Strict Frame Sandboxing: Webmail architectures must render untrusted HTML email bodies inside isolated <iframe> containers with rigid sandbox attributes. The frame should omit allow-same-origin wherever possible to ensure that even if CSS breaks out of its immediate container, it cannot access the parent DOM or host application context.
2. Aggressive CSS Property Whitelisting: Sanitizers must move away from blacklisting known bad rules and enforce strict whitelists. High-risk capabilities must be completely stripped, including positional CSS (position: fixed, position: absolute), pseudo-element generators (:before, :after), complex dynamic selectors (:has(), attribute prefix/suffix matching), custom data attributes, and form field styling like -webkit-text-security.
3. Server-Side Proxying and Image Sanitization: All external media references—including CSS functions like url(), image-set(), and @import rules—must be rewritten and strictly mediated by a hardened server-side proxy. CSS rules referencing non-proxied external resources or custom web fonts should be systematically stripped prior to rendering.
4. AI Agent Input Sanitization: Integrated AI assistants must process raw, plain-text email content rather than DOM trees containing rendered CSS pseudo-elements. AI pipeline parsers should explicitly strip all presentation markup, inline styles, and generated CSS content to prevent indirect prompt injection attacks.

Gareth Heyes’ Black Hat USA 2026 presentation marks a definitive turning point in client-side web security. As webmail platforms continue to introduce rich UI features and AI integrations, security teams must recognize that CSS has evolved into a powerful Turing-complete style language capable of executing complex attacks. Without strict sandboxing and rigorous CSS sanitization, the inbox will remain vulnerable to silent, scriptless exploitation.