Executive Summary
PortSwigger research shows CSS inside an email can escape its message boundary in Outlook, Gmail, Fastmail, Proton Mail, Yahoo and AOL webmail to capture passwords, leak tokens, hijack UI actions and manipulate AI tools that read email.
What Happened
New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. PortSwigger researcher Gareth
Affected Products
- Outlook
- Gmail
- Fastmail
- Proton Mail
- Yahoo Mail
- AOL Mail
Vulnerability / Attack Technique
CSS injection breaking webmail isolation, including manipulation of AI email tools
Technical Mechanism
Crafted CSS in an email alters the webmail interface outside the message, capturing input and influencing AI assistants that read the mailbox.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
The AI angle: email content can also steer assistants that summarize or act on mail. RealGround analysis: email assistants need the same untrusted-input handling as other agents.
Recommended Controls
- Apply webmail vendor fixes
- Limit actions email AI assistants can take without confirmation
Related RealGround Service
AI Security Readiness Assessment · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.