Harish Kumar 
Security researcher Gareth Heyes has exposed a sweeping set of vulnerabilities showing that the CSS sanitization webmail providers rely on to keep users safe can be twisted into a full attack chain, one capable of hijacking browser UI, exfiltrating authentication tokens, and even logging keystrokes in real time.
The research, spanning Gmail, Outlook, Fastmail, ProtonMail, Yahoo Mail, and AOL Mail, reframes a decades-old assumption: that “sanitized” CSS is inherently inert.
Webmail clients must render untrusted HTML/CSS from senders while protecting the trusted interface around it. Sanitizers try to strip dangerous syntax, but Heyes found the browser’s actual rendering behavior often diverges from what the sanitizer assumes is safe a discrepancy he exploited repeatedly.
Webmail CSS Flaws Enable Token Theft
Some clients go further, filtering CSS only after the browser’s own CSS Object Model (CSSOM) has parsed it, but Heyes showed that this handoff can mutate seemingly harmless code into malicious selectors that escape the sandbox entirely, as demonstrated by real bugs found in Fastmail.
Using overlooked HTML label elements, Heyes found he could hijack UI actions in Outlook, pinning messages or toggling interface controls without the victim’s consent, a flaw Microsoft has left unpatched.
More strikingly, he demonstrated indirect prompt injection against OpenAI’s Atlas browser: hidden CSS content invisible to a human victim but readable by an AI assistant could manipulate the assistant into opening malicious tabs and exfiltrating a user’s name, all triggered by an innocuous “translate” request.
Perhaps the most technically striking finding involves brute-forcing secret tokens solely via CSS attribute selectors and nested rules, bypassing Content Security Policy protections intended to block external requests.
Heyes showed this technique could extract a 12-character authentication token from services like Medium, and separately built a “font-height oracle” using CSS animations and font-face tricks to infer numeric codes character by character, no scripting required.
Building on CSS gadgets found in Outlook’s DOMPurify implementation, Heyes constructed a fully functional, real-time password keylogger using only sanitized CSS and HTML, exploiting a browser timing quirk in <select> elements to capture keystrokes as a victim types, then rendering a convincing fake Microsoft login screen to harvest credentials.
“The real danger here isn’t one clever bypass it’s that sanitizers keep treating CSS as decoration, when in practice it’s Turing-adjacent enough to build keyloggers, oracles, and prompt-injection payloads.
Until webmail providers isolate untrusted content behind sandboxed iframes as a default posture rather than an afterthought, every new CSS feature is a fresh attack surface waiting to be discovered.” cybersecurity threat analysis desk
Heyes’ recommended defenses are blunt: isolate untrusted email content in sandboxed iframes, block image and data: URL requests by default, strip dangerous selectors like :has() and :checked, and avoid CSSOM-based filtering that invites mutation bugs.
Fastmail paid out bounties and patched several issues; Gmail and ProtonMail’s responses were reportedly less receptive despite confirmed impact.
The research underscores a broader lesson for the industry: as AI browsers and agents increasingly parse email content automatically, the attack surface isn’t shrinking; it’s multiplying.
About the Author
Kiran 
