RESEARCHERS have revealed that CSS injection flaws in major webmail services enable attackers to steal passwords and session tokens. The findings affect Gmail, Outlook, Fastmail, Proton Mail, Yahoo Mail and AOL Mail. The technique bypasses existing sanitisation and can be used to craft convincing phishing elements inside legitimate messages, as detailed in a report on SecurityAffairs published today.
Gareth Heyes of PortSwigger showed that allowing certain CSS properties lets an attacker embed a fake dropdown that mimics a password entry box, capturing keystrokes in real time in his research. In Yahoo and AOL, abuse of the copy‑paste mechanism can leak login tokens when users paste crafted content. The attacks rely on the webmail clients’ acceptance of inline style sheets that are not stripped during rendering. No user interaction beyond viewing or interacting with the message is required for the payload to succeed.
Because no CVE has been assigned, the flaw is tracked only by the researcher’s advisory. The severity is rated high because the vector works without needing a software bug, merely exploiting a feature that is intentionally allowed. Successful exploitation gives the attacker access to credentials that can be reused across services, increasing the risk of account takeover.
So far no threat actor has been linked to active exploitation of these CSS flaws in the wild, but the proof‑of‑concept demonstrates a realistic path for credential theft. The research notes that the same techniques could undermine AI‑powered email assistants that parse incoming mail for smart replies or summarisation, a point highlighted in a recent article on The Hacker News earlier this week. This expands the potential impact beyond manual phishing to automated abuse of trusted AI features. Organisations that rely on such assistants should therefore review their email sanitisation policies.
Defenders should enforce strict content security policies that disallow inline CSS and limit allowed properties to a safe subset. Webmail providers must sanitise incoming HTML by stripping or neutralising style tags and preventing the use of positioning or display tricks that could overlay fake UI. End‑user training should warn against entering credentials in any form presented inside an email, even if it appears to be a legitimate part of the message. Monitoring for anomalous token usage after a suspicious message can help detect compromise early.
Security teams can deploy behavioural analytics to spot abnormal token usage following a suspicious email, and consider disabling automatic copy‑paste‑based token generation in legacy platforms. Keeping webmail clients up to date with the latest patches from vendors will mitigate known bypasses, although the current flaws rely on feature misuse rather than a bug that can be patched directly. Regularly reviewing the rendering engine’s handling of CSS will help close the gap before attackers refine the technique.