New research has revealed that CSS content embedded in emails can break out of its intended message boundary and interfere directly with the surrounding webmail interface. The findings, detailed by a PortSwigger researcher identified as Gareth, span attack chains affecting Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.

Webmail clients typically sandbox the rendering of email content, styling included, to prevent a malicious message from affecting the look or behavior of the surrounding application chrome. This research shows that these boundaries are not as solid as assumed. By exploiting how CSS is parsed and applied within these platforms, an attacker can cause styles defined inside an email to bleed into and manipulate elements of the webmail client itself.

Impact Across Multiple Providers

According to the research, the technique enables a range of outcomes depending on the target platform and attack chain used, including:

  • Capturing user passwords entered into what appear to be legitimate interface elements
  • Taking over third-party accounts linked to the webmail service
  • Leaking authentication tokens
  • Hijacking trusted UI actions that users expect to behave safely
  • Manipulating AI-based tools that read and process email content

The inclusion of AI-driven email assistants as a manipulation target is notable. As webmail providers increasingly integrate AI features to summarize, triage, or act on email content, a boundary-escaping CSS attack could potentially influence what those AI tools perceive or act upon, extending the risk beyond traditional phishing or credential theft.

Why This Matters

Because the attack relies on CSS, a core web styling technology present in virtually every email client’s rendering pipeline, the underlying weakness is not tied to a single vendor’s implementation quirk. Instead, it points to a broader class of boundary enforcement failures common across webmail platforms that render HTML and CSS content from untrusted senders.

Security teams should treat email-borne CSS as a potential attack surface, not just a cosmetic rendering concern. Organizations relying on webmail platforms, particularly those with integrated AI assistants, should monitor vendor advisories for patches addressing CSS sandboxing and rendering isolation as more details from this research become available.