Heyes Shows 12-Character Token Theft and AI Abuse via CSS in Gmail, Outlook

Q: How can attackers extract your private tokens using just visual CSS tricks without ever triggering a suspicious network request?

Attackers can leak tokens with no obvious outbound fetch by turning CSS into a visual filter and making the victim’s normal click do the exfiltration. In Heyes’s webmail research, the attacker injects styles into the email so CSS tests what digits appear in a token shown on screen. Based on those matches, the styles hide all non-matching links and leave only the attacker-chosen link active or spanning the clickable area. The key point is that the browser is not making a suspicious background request to probe the token character by character. CSS is used locally, inside the page, to sort and reveal information visually. The exfiltration happens only when the user performs an ordinary action, such as clicking what looks like a normal link or part of the interface. That click carries the selected digit data to the attacker’s server. This matters in environments with strict Content Security Policy, where direct external loads such as images or fonts may be blocked. Even then, if an attacker can inject style rules, CSS selectors can still act as an oracle: they determine which characters are present and how often, then reshape the page so the user’s click encodes the answer. In practice, that means a “read-only” rendering bug can still become token theft. The browser appears to stay within policy until the victim clicks, but the page has already been rigged so that the click leaks the token fragments the attacker inferred visually.

3 articles · Updated · Security Affairs · Aug 9

Outlook and Gmail remained vulnerable as of Aug. 6 to CSS-based attack chains Gareth Heyes said could steal passwords, hijack sessions and leak inbox-linked data.
Heyes said the attacks work because webmail clients let untrusted HTML and CSS interact with trusted interface elements, or because browser rendering diverges from what sanitizers approve.
In Outlook, allowed labels and a CSS gadget using position:fixed let an email escape its message pane and mimic a password field; in Firefox, the setup could capture typed input nearly in real time.
Yahoo Mail and AOL Mail exposed a copy-paste path that leaked a 12-character Medium login token, while Gmail's image-set() fallback enabled an external request that fed an indirect prompt-injection chain against Anthropic's Claude Cowork.
Fastmail patched two CSS mutation bugs and a Proton Mail proxy bypass no longer worked before publication, but Heyes and PortSwigger still urged sandboxed iframes, stricter CSS allow-lists and tighter image-request controls.

Sources

Security Affairs16d ago

Researcher Gareth Heyes Exposes CSS Attacks on Major Webmail Services and AI Tools

mallory.ai17d ago

CSS Email Attacks Breach Webmail Boundaries to Steal Passwords and Tokens | Mallory

abijita.com16d ago

Webmail Security Flaws Let Email Content Break Out of the Inbox and Steal Sensitive Data

7 Sources

If security filters and browsers interpret code differently, can any webmail platform truly guarantee that an email won't steal your passwords?

With public exploit code available, are your AI assistants silently leaking corporate secrets through seemingly harmless email formatting?

How can attackers extract your private tokens using just visual CSS tricks without ever triggering a suspicious network request?

The 2026 CSS Injection Crisis: Exploiting Webmail and AI Assistants Without JavaScript

Overview

In August 2026, Gareth Heyes revealed at Black Hat how CSS and HTML alone can be weaponized to bypass traditional email security, leading to rapid responses from some providers like Fastmail, who patched and rewarded bug discoveries, while others such as Proton Mail silently fixed issues. The report highlights how failures in sanitization, like Roundcube’s improper comment handling, enabled attackers to hide malicious CSS, and browser-specific flaws—such as Chrome’s real-time selector evaluation—allowed fast data exfiltration. These vulnerabilities extend to AI-driven tools and authentication protocols, showing that CSS-based attacks now threaten not just webmail but the broader web application ecosystem.

...