New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

Research describes HTML- and CSS-based attack techniques that can allow email content to escape its message boundary and interfere with the webmail interface. Proofs of concept demonstrated potential password and token theft, hijacking of trusted UI actions, and manipulation of AI tools that process email across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. The research does not report malicious exploitation; public PoCs were available as of August 8.