Your Webmail Could Be Leaking Passwords Right Now

Emily Davis · 2026-08-08

You probably think your inbox is a safe place. You log in, scan your messages, and go about your day. But what if an email itself could break out of its little box and start messing with the entire webmail interface? That's not science fiction. New research shows it's happening right now across some of the biggest email platforms in the world. PortSwigger researcher Gareth Heyes uncovered a series of attack chains that target Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. These aren't just minor annoyances. We're talking about stolen passwords, hijacked third-party accounts, leaked tokens, and even manipulation of AI tools that read your email for you. Here's the thing: most people assume email content is sandboxed. You think of it like a letter inside an envelope—sealed, contained, harmless until you open it. But these CSS-based attacks treat that envelope like wet paper. They can escape the message boundary and interact with the webmail interface itself. ### How CSS Breaks the Walls CSS stands for Cascading Style Sheets. It's the code that controls how web pages look—colors, fonts, spacing. But it can do a lot more than that. Attackers can craft emails with specially designed CSS that tricks the browser into treating parts of the email as part of the webmail app. Think of it like this: you're in a museum looking at a painting. Suddenly, the painting's frame starts moving and rearranging the room around you. That's essentially what these CSS attacks do. They blur the line between the email content and the webmail interface, allowing malicious code to interact with things it should never touch. The research shows multiple ways this can play out. In some cases, the attacks capture passwords as you type them. In others, they take over third-party accounts by stealing session tokens. The scariest part? Some attacks can even hijack trusted UI actions, like the "reply" or "forward" buttons you click every day. ### The AI Email Problem Here's a twist that makes this even more concerning. More and more people are using AI tools to read and summarize their emails. These tools are supposed to save you time. But if an attacker can manipulate what those AI tools see, they can feed false information or extract sensitive data. Imagine asking your AI assistant to summarize a work email, and instead, it reveals your password to a third-party service. That's the kind of scenario the researcher describes. It's not just about protecting your inbox anymore. It's about protecting every system that connects to it. ### What This Means for You If you use any of the affected webmail platforms, you need to pay attention. The good news is that these attacks require specific conditions to work. They're not mass-spam level threats. They're targeted, sophisticated, and require a certain level of skill to execute. But here's the uncomfortable truth: the defenses that webmail providers have built are not impenetrable. The research shows that even major players like Gmail and Proton Mail have gaps. And once a researcher publicly discloses these techniques, you can bet that malicious actors are already working to adapt them. ### Practical Steps to Protect Yourself You don't need to panic, but you should take action. Here are some things you can do right now: - **Use a dedicated email client** instead of webmail when possible. Desktop apps often have stricter rendering controls. - **Disable HTML rendering** in your email settings if your provider allows it. Plain text might look boring, but it's much safer. - **Keep your browser updated**. Modern browsers patch CSS-related vulnerabilities regularly. - **Be wary of unexpected emails** from unknown senders, especially if they contain unusual formatting or hidden elements. - **Consider using an antidetect browser** for sensitive email accounts. These tools isolate your browsing sessions, making it harder for cross-site attacks to succeed. The last point is worth emphasizing. Antidetect browsers create separate browser fingerprints for each session, which means an attack that works in one context won't automatically work in another. It's like having a different disguise for every room you enter. ### The Bottom Line This research is a wake-up call. Email has been a core part of our digital lives for decades, and we've grown complacent. We assume the platforms we trust are doing everything they can to protect us. And they are—but they're fighting an uphill battle. CSS attacks are clever because they exploit the very technology that makes the web look good. They're not brute-force hacks. They're elegant, subtle, and dangerous. The fact that they can break out of email boundaries and touch the webmail interface itself means the threat model has changed. You don't need to become a security expert overnight. But you do need to understand that your inbox is not as safe as you thought. Stay informed, stay cautious, and consider adding layers of protection to your most sensitive accounts. Because in the end, the best defense isn't just better software. It's awareness. And now you know.