Webmail CSS Abuse Lets Attackers Steal Credentials and Hijack AI‑Powered Email Tools
What Happened — Security researcher Gareth Heyes demonstrated that plain CSS embedded in malicious emails can break out of the message sandbox in major webmail services (Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, AOL Mail). By abusing allowed CSS properties or exploiting gaps between sanitizers and browsers, the technique can capture passwords, hijack sessions, and manipulate AI assistants that read the inbox.
Why It Matters for Compliance & Audit Readiness
- The attack targets the very same trust boundaries that SOC 2 Access Control criteria (CC6.1, CC6.2) require you to protect with strict UI segregation and input sanitization.
- Demonstrates a need for continuous evidence that your email‑gateway and UI controls are effectively monitored and that any deviation is logged and remediated.
- Highlights the importance of Security Awareness Training: users must recognize suspicious styling cues and avoid entering credentials in unexpected UI elements.
Who Is Affected – SaaS email providers, enterprises that rely on webmail for internal communication, and any organization that integrates AI assistants (e.g., OpenAI’s Atlas) with mailbox data.
Recommended Actions
- Review and tighten CSS/HTML sanitization policies against the “allow‑list” bypass techniques described.
- Implement UI‑level controls that isolate credential entry fields from any DOM elements injected by email content.
- Add the CSS‑gadget scenario to phishing‑simulation and security‑awareness curricula.
- Capture and retain logs of DOM‑manipulation events as audit evidence for SOC 2 access‑control testing.
Source: Security Affairs
Technical Notes – The attack leverages CSS properties such as position:fixed and custom data attributes that are mistakenly allowed by webmail sanitizers. In Outlook, a JavaScript library appends elements with these properties, enabling a hidden dropdown to capture keystrokes. Similar vectors exist in Gmail, Yahoo Mail, and AI‑integrated tools that read inbox content. No CVE is assigned; the issue is a sanitizer misconfiguration rather than a software bug.