New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens
Summary: PortSwigger researcher Gareth Heyes presented research at Black Hat USA 2026 showing that HTML and CSS inside an email can escape the message boundary and interfere with the webmail interface across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. One Outlook/Firefox chain spoofs a Microsoft sign-in screen and captures the typed password, a Yahoo/AOL paste race exposes a 12-character Medium login token, and a Gmail chain exfiltrated a Slack token after indirect prompt injection through Anthropic's Claude Cowork.
Key Takeaway: The paper reports proof-of-concept work with public PoCs still available as of August 8, and it does not state whether the full Outlook password-capture chain was fixed, while Outlook label-jacking and Gmail's image-set() bypass still worked when the research was published on August 6. A single captured 12-character token or typed password is enough for an attacker to sign in as the victim.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026