Security researcher Gareth Heyes of PortSwigger presented research at Black Hat USA 2026 showing that carefully crafted HTML and CSS inside an email can escape the message boundary and attack the webmail interface itself — enabling attackers who can get a target to open a malicious email to steal the victim’s password or session token without any JavaScript. The attack takes advantage of HTML and CSS features that webmail services deliberately allow inside email content, then exploits parsing discrepancies between what sanitizers approve and what browsers ultimately render.
The research demonstrated several distinct attack chains across six major providers. Against Outlook, a spoofed sign-in screen can be constructed entirely from allowed HTML and CSS — the user sees a convincing login prompt inside the webmail UI and types in their credentials, which go directly to the attacker. Gmail was found vulnerable to an image-set() CSS bypass that leaks data without JavaScript. Fastmail patched two CSS mutation bugs during the disclosure process. Proton Mail’s proxy bypass stopped working during retesting, suggesting that hardening update took effect. Yahoo Mail and AOL were also shown to be vulnerable across various chains. The core problem is that email HTML allows a broader set of CSS properties than web pages typically do, and webmail providers have to parse and sanitize enormous volumes of incoming messages at speed — gaps in that sanitization are what these attacks exploit. Heyes published the research on August 6, 2026; the Outlook password-capture chain and Gmail’s image-set() bypass were both still functional as of that date.