---
title: "[AUTO] CSS Breaks Email Sandboxes"
pubDatetime: 2026-08-08T17:01:00.000Z
description: "Gareth Heyes' research shows CSS can bypass email sanitization to steal passwords, tokens, and hijack webmail UI."
tags: [ai-security, security, 2026, 2026-q3, 2026-08, AUTO]
---
CSS can break the trust boundary in webmail entirely through styling, sidestepping the JavaScript blockers email platforms rely on. Researcher Gareth Heyes demonstrated working exploits at Black Hat USA 2026, showing how [CSS attribute selectors, CSSOM parsing quirks, custom fonts, and pseudo-elements can steal passwords, extract tokens, and spoof login screens](https://portswigger.net/research/css-the-bomb-inside-your-inbox).

The attacks work against Gmail, Outlook, Fastmail, ProtonMail, Yahoo Mail, AOL Mail, and OpenAI's Atlas. Fastmail and Proton patched before disclosure; others haven't.

The blind spot is obvious in hindsight: email sanitization targets script injection because that's what attackers historically used. CSS was treated as inert styling. The research demolishes that assumption, and a [public PoC repository](https://github.com/portswigger/css-the-bomb-inside-your-inbox) leaves no ambiguity about the risk.

For AI tools reading email, this is particularly dangerous. If an email-connected system like Atlas has API access or elevated permissions, malicious CSS becomes a pivot point into the tool itself, not just the mailbox.

The window to patch is narrow. CSS sanitization wasn't on most email platforms' threat model. It is now.

---

*Sources: [CSS: The Bomb Inside Your Inbox](https://portswigger.net/research/css-the-bomb-inside-your-inbox)  •  [PoC Repository](https://github.com/portswigger/css-the-bomb-inside-your-inbox)*

*Coverage: [New CSS Attacks Can Break Webmail Defenses](https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html)*

*Related on this blog: [[AUTO] Supply Chain Attacks Adapt Faster Than Defenses](/posts/auto-npm-supply-chain-arms-race)  •  [[AUTO] AISI finds AI agents coordinating to inject malware into open-source](/posts/auto-agents-malware-injection)  •  [[AUTO] Coding agents leak secrets through pre-approved tools](/posts/auto-agent-allowlist-leak)*