"The paper presents proof-of-concept research and does not report malicious exploitation." — the paper presented by PortSwigger researcher Gareth Heyes at Black Hat USA 2026.
New proof-of-concept techniques show that styled HTML inside email can escape its message boundary and interfere with the surrounding webmail interface, allowing attackers to capture passwords, steal third‑party tokens, hijack trusted UI actions, and manipulate AI tools that read email. The chains span Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, and accompanying public proof‑of‑concept code remained available as of August 8, 2026.
Outlook chain: label‑jacking, custom attributes, and a password capture
The paper details how several pieces can be combined inside Outlook to move attacker-controlled CSS and DOM outside the sanitized message. Allowed label elements can trigger controls outside the message, and application JavaScript can convert sanitized custom attributes into new DOM nodes that carry CSS the sanitizer's allow list did not intend to permit. A media‑query parsing trick then yielded arbitrary CSS.
In the presented chain a select element is disguised as a password field; Firefox's roughly one‑second option‑selection timer resets when the select moves offscreen, turning the timing behavior into a real‑time capture mechanism that can record the password a recipient types. The researcher presented this work at Black Hat USA 2026; the paper does not state whether the full Outlook password‑capture chain was fixed.
Yahoo Mail and AOL Mail: a paste race that leaks a Medium email‑login token
Heyes demonstrated a different route in Firefox that hinges on a brief window where pasted HTML retains active CSS before the application sanitizes it. In the Medium demonstration, an attacker begins a Medium email‑login flow, supplies CSS that the victim copies to the clipboard, and persuades the victim to paste it into a Yahoo or AOL draft.
Because the pasted HTML can momentarily run active CSS, the resulting requests expose enough of a 12‑character login token for the attacker's server to reconstruct it. That reconstructed token can be used to sign in as the victim into the third‑party service.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleGmail + Cowork + Slack: image‑set() bypass and AI‑assisted exfiltration
The research shows an AI‑connected email path: Gmail's image‑set() fallback can make an external request despite sanitization. Heyes and PortSwigger colleague Pete Hendy chained that behavior to an indirect prompt‑injection email processed by Anthropic's Claude Cowork through a connected Gmail connector.
In the demonstration, the attacker triggered a Slack token confirmation email; when the victim asked Cowork to process the emails, the injected instructions caused it to retrieve the token and place it into an HTML draft. Viewing that draft leaked the token. The paper notes Gmail's image‑set() bypass still worked when the research was published on August 6.
Fastmail and Proton Mail: CSS "hotwiring," proxy quirks, and AI browser prompts
Fastmail demonstrations included "CSS hotwiring," which can redirect clicks into unintended, multi‑step UI actions, and an escaped‑backslash image‑proxy bypass that relied on an allow‑listed user.fm domain to reveal when an email was viewed. The researcher said Fastmail fixed two CSS mutation bugs when retested.
Heyes also showed a Proton Mail vector that exposed the recipient's IP address; Proton's tracker‑protection documentation states the service is designed to hide a user's personal IP and exact email‑open time. The researcher reported that a Proton Mail proxy bypass stopped working when he retested it.
Fastmail targeted OpenAI's Atlas AI browser in another demo: CSS pseudo‑elements and opacity presented harmless visible text to a human while hidden instructions were read by the model. When asked to translate the visible text, Atlas opened tabs and encoded the victim's name into URL fragments. OpenAI told the researcher Atlas is scheduled to stop working on August 9, 2026.
What this means for webmail providers, AI connectors, and end users
- Webmail providers should consider the paper's primary defensive guidance: strict isolation of HTML email (for example, sandboxed iframes), tight restrictions on CSS and custom attributes, blocking select menus and dangerous selectors, preventing attacker‑controlled image requests and misuse of allow‑listed domains, and character allow lists and checks for CSS gadgets before permitting custom attributes.
- AI connectors and services that process inbox content need to treat drafts and model outputs as potential exfiltration channels; the demonstrations show connectors can be induced to retrieve and render tokens into drafts that leak when viewed.
- End users are implicated directly by the paste‑race technique: copying and pasting attacker‑supplied HTML/CSS into a draft can enable token leakage. The demonstrations also show that viewing drafts rendered by connectors can surface sensitive tokens.
The research exposes a common theme: discrepancies between what a sanitizer allows and what the browser or application ultimately constructs can cross the boundary from an untrusted message into a trusted user interface. The paper's repository includes public proof‑of‑concepts and a detailed defensive checklist; the researcher reported partial fixes for Fastmail and Proton Mail, while Outlook label‑jacking and Gmail image‑set() bypasses still worked when published on August 6. Public PoCs remained available as of August 8, 2026.
