Breaking Lab srl
When the Email Container Becomes the Weapon
Email has always been a favorite attack surface for cybercriminals, but a newly published body of research from PortSwigger — the team behind the Burp Suite security toolkit — reveals a class of vulnerabilities that cuts far deeper than the average phishing link. Researcher Gareth Heyes has demonstrated that carefully crafted CSS instructions embedded inside an email message can break free of the message rendering sandbox and interact directly with the surrounding webmail application interface. The implications are severe: attackers who send the right email don’t need the recipient to click anything suspicious at all.
What the Attacks Actually Do
Heyes documented multiple distinct attack chains, each exploiting how different webmail clients handle style information inside incoming messages. When webmail providers render HTML email, they attempt to isolate the message’s styling from the rest of the page. The research shows those boundaries are far more porous than assumed. By injecting malicious CSS payloads, an attacker can cause the webmail client to leak session tokens, expose saved passwords, hijack trusted UI elements such as confirmation buttons, and even manipulate AI-powered features that automatically read or summarize email content.
The affected platforms identified in the research include some of the world’s most widely used webmail services: Microsoft Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. That breadth is particularly alarming — this is not a niche edge case affecting a small provider, but a class of vulnerability that spans very different underlying codebases and architectures, suggesting the root problem is partly inherent to how HTML email is designed to work.
No Clicks Required
What distinguishes this attack category from conventional email-borne threats is the passive nature of exploitation. Traditional phishing requires a victim to click a malicious link or open a weaponized attachment. CSS-based attacks of this type can trigger the moment a message is opened and rendered — or, in the most alarming variants, simply when it appears in a preview pane. For enterprise environments where employees receive hundreds of emails a day, the risk of inadvertent exposure is extremely high.
The attack vectors documented by Heyes include techniques for capturing credentials typed into login forms that appear within the webmail interface, taking over OAuth flows for third-party applications linked to the email account, and even poisoning the prompts fed to AI summarization tools built into modern webmail clients. The last of these is especially novel: as providers race to add generative AI features to their email products, each new AI integration creates a fresh surface through which CSS-injected instructions might travel.
How Providers Are Responding
The PortSwigger team followed responsible disclosure procedures, notifying affected vendors before publishing the full technical details. Responses from the various platforms have varied in speed and completeness, which is itself a concern given that multiple major providers share exposure to the same underlying technique. Patching CSS isolation bugs is notoriously difficult because overly aggressive sanitization can break legitimate email formatting that millions of users rely on daily. Vendors must therefore walk a fine line between locking down the rendering environment and preserving the rich-text experience their users expect.
Users of affected platforms should ensure their clients are fully updated and consider disabling automatic HTML rendering where their provider allows it — opting instead for plain-text display of unknown messages. Security teams should also review whether AI email features can be restricted to trusted senders only, reducing the attack surface for prompt injection through CSS.
A Structural Problem in Email’s DNA
This research is a timely reminder that email’s fundamental architecture — designed decades before modern web security concepts existed — continues to generate vulnerabilities that are genuinely difficult to eliminate without breaking the format itself. As webmail clients add more JavaScript, more AI, and richer interactive features, the boundary between “email content” and “application interface” becomes increasingly blurred. The industry urgently needs stricter, standardized sandboxing requirements for HTML email rendering, ideally enforced at the protocol level rather than left to each provider’s own discretion. Without that, the next clever CSS trick is likely already being written.
