CSS:the bomb inside your inbox
Summary: PortSwigger researcher Gareth Heyes found that webmail clients including Yahoo Mail, AOL Mail, Fastmail, ProtonMail, Gmail and Outlook render untrusted CSS in a trusted UI, and that sanitizer-versus-browser parsing discrepancies let him spoof UI actions, exfiltrate tokens and steal passwords. He demonstrated a real Outlook bug that opens the UI ribbon and pins a message to the victim's Outlook, which he says Microsoft has not fixed, and showed that pasting clipboard HTML into AOL and Yahoo Mail briefly flashed page text red, indicating a race condition in CSS sanitization.
Why it matters: Heyes showed a 12-character hex token from Medium's email login could be brute-forced through nested CSS attribute selectors and stolen after a victim pasted into a draft, letting an attacker log in as that user - and he says almost any 12-character hex token is exposed the same way.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026