A newly disclosed findings show that seemingly harmless in emails can be weaponized to steal login credentials, hijack authentication tokens, and manipulate AI-powered browsers, all while bypassing the sanitization filters webmail providers rely on to keep users safe.
Webmail clients such as Gmail, Outlook, Fastmail, ProtonMail, Yahoo Mail, and AOL Mail must render untrusted HTML and CSS from incoming emails without exposing users to harm.
that discrepancies between what these sanitizers consider safe and what browsers actually render create exploitable gaps, some serious enough that Fastmail paid real bug bounties to have them fixed.
CSS Email Attacks Let Hackers Steal Passwords
One of the most striking findings involves OpenAI’s Atlas browser. Heyes used CSS before-and-after pseudo-elements, combined with near-zero opacity, to create a mismatch between what a victim sees and what an AI reads.
[embedded content]
A victim might see French text that needs translation, while the underlying language model reads hidden, injected instructions instead.
When the victim triggers a keyword such as “translate,” Atlas executes attacker-defined debugging steps that extract the victim’s name from the page and exfiltrate it by automatically opening browser tabs to attacker-controlled URLs.
Token theft proved possible without any JavaScript at all. Using pure CSS attribute selectors combined with nested selectors, Heyes demonstrated hex authentication tokens, including a real login token belonging to Medium.com, by triggering background-image requests that leak data character by character.
Even when Content Security Policy blocked all external resources, he built a font-height oracle using font-face rules, unicode-range, and CSS animations to measure digit frequency and exfiltrate numeric tokens purely through link clicks, with no scripting required.
By abusing what Heyes calls CSS gadgets, meaning DOM elements injected by legitimate libraries using CSS properties outside the sanitizer’s allow-list such as position:fixed, he broke out of the email’s trust boundary entirely.
Combined with select and option elements styled to mimic password fields using the webkit-text-security property, plus a Firefox timing quirk that resets input delays when elements move off screen, he built a fully functional of spoofing a convincing Microsoft login screen inside an email, all while passing through DOMPurify filtering.
[embedded content]
Other techniques uncovered include CSS hotwiring, which hijacks clicks anywhere on a page to trigger unintended UI actions, such as pinning messages or opening sidebars, because pseudo-elements inherit their parent’s click events.
Abuse of HTML label elements with unfiltered “for” attributes to remotely control Outlook’s ribbon interface; CSSOM mutation bugs in Chrome that transform sanitized keyframes and media-query CSS into malicious selectors after parsing.
Clipboard-based attacks where malicious CSS pasted into draft emails silently steals tokens through race conditions in AOL and Yahoo Mail.
Vendor responses have varied. Fastmail paid $1,000 bounties for two mutation bugs and fixed them, while Outlook’s label-hijacking bug reportedly remains unpatched.
ProtonMail disputed a similar finding despite it contradicting the company’s own tracker-protection documentation, and Gmail has yet to resolve an image-set bypass despite repeated reports.
Heyes recommends isolating email content in sandboxed iframes, blocking data URLs and select menus in HTML sanitizers, disallowing risky CSS pseudo-classes like has, checked, and focus, enforcing strict character allow-lists to prevent CSSOM mutation, and mandating image proxies for all remote resource requests to limit tracking and exfiltration.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN.