CSS: The bomb inside your inbox
Webmail clients render untrusted HTML and CSS, relying on sanitizers to keep users safe. But sanitizers can be bypassed, and Gareth Heyes shows how. He demonstrates attacks on Outlook, Fastmail, Gmail, ProtonMail, and more, including abusing HTML labels to control UI, using CSS pseudo-elements to hide text from AI browsers like OpenAI's Atlas, stealing tokens via clipboard paste, and even exfiltrating passwords. The research reveals that CSS sanitization is far from bulletproof, with real-world impacts.
Trouble is you can create discrepancies between what the sanitizer thinks is safe and what the browser actually renders.
- PoignardAzur
Reading the article, I kept thinking: "could you defeat this with an iframe?", and indeed:
> One of the best methods to protect against these attacks is strict isolation. If you isolate the email message using sandboxed iframes you restrict the ability to break out of trusted boundaries. If you are not using sandboxed iframes, always be careful when allowing custom attributes and check for HTML/CSS gadgets. Use a strict allow list of characters when validating keywords and names to avoid mutation when using the CSSOM.
iframes should be the first layer of any defense-in-depth against user-submitted content.
- dabinat
Email rendering is such a mess. It’s insane that the standard way to lay out an HTML email in 2026 is with tables.
If you look at https://www.caniemail.com/scoreboard/ there are even different results for the same client on desktop vs mobile.
It seems like browsers moved with the times and email got stuck in 2005.
- esprehn
The frustration with the Gmail triager is typical unfortunately. Google teams have outsourced almost all user issue triage to contractors and the actual engineers don't interact with the community or users. Hopefully some Googler sees this and can get the Gmail team to fix it. The image proxy is useless if emails can trivially work around it.
- Waterluvian
This website was pretty nasty to my browser history and pretty much kidnapped my tab on mobile safari.
- ksbd-pls-finish
>When the user types this command Atlas will open some browser tabs and exfiltrate the victim's name from the current web page and send it to a remote server via the hash.
But the remote server doesn't see the hash? This casts doubt into the content, since the attack was clearly not tested. Am I missing something?
It's a pretty interesting post though, but hardly surprising - touching and rendering untrusted content is always risky.