Jakub Zerdzicki/Getty Images Programming languages that power the internet are often a lot older than you think. While a ton of new frameworks or variations on popular languages are released regularly, major sites and most of the internet still hinge on languages that predate the world wide web in some spots. These languages are a … Read more

A newly disclosed findings show that seemingly harmless in emails can be weaponized to steal login credentials, hijack authentication tokens, and manipulate AI-powered browsers, all while bypassing the sanitization filters webmail providers rely on to keep users safe. Webmail clients such as Gmail, Outlook, Fastmail, ProtonMail, Yahoo Mail, and AOL Mail must render untrusted HTML … Read more

Security researcher Gareth Heyes has revealed techniques for , the technologies used to format emails, to manipulate user interfaces, leak authentication data, and in some cases, capture passwords. Webmail services need to display HTML controlled by the sender without compromising the security of the mailbox application. To achieve this, providers sanitize the markup and restrict … Read more

A new class of email-based attacks that exploit ordinary CSS styling code to hijack webmail interfaces, spy on user activity, and even steal passwords in real time, all without relying on JavaScript or traditional malware. Dubbed “CSS bomb” attacks, the technique weaponizes trusted formatting features found in nearly every major webmail platform, turning a routine … Read more

Webmail CSS Attacks Expose a New Risk for AI-Powered Email Tools August 09, 2026 CSS attacks on major webmail services can steal credentials, hijack sessions and manipulate AI tools connected to users’ inboxes. PortSwigger researcher Gareth Heyes demonstrated something that should make every webmail team a little nervous: plain CSS, the styling language that’s supposed to … Read more