CSS Webmail Attacks: Password, Token, and AI-Agent Exfiltration Risks for Enterprises

New PortSwigger research demonstrates how HTML and CSS permitted within email content can be abused to cross webmail trust boundaries, interfere with trusted interface elements, spoof login experiences, and exfiltrate sensitive tokens.

Inside the Webmail Attack Chain

The research highlights two related failure modes: webmail clients allow attackers to abuse HTML and CSS primitives beyond their intended scope, while sanitizer/parser discrepancies cause systems to interpret or transform previously filtered content into a dangerous form. PortSwigger demonstrated both patterns across multiple webmail environments.

In Outlook, the attack was more complex than simply combining allowed elements with CSS. PortSwigger found that Outlook allowed certain custom data attributes that application code subsequently processed into new DOM elements, creating what the researcher calls CSS gadgets. Combined with sanitizer weaknesses and Firefox-specific behavior, these techniques enabled a convincing Microsoft sign-in interface and password capture.

In Yahoo Mail and AOL Mail, researchers identified a paste-related race condition. When a user pasted specially crafted HTML into a draft, its CSS could execute briefly before the platform completed sanitization. In the proof of concept, researchers used CSS attribute selectors and outbound requests to reconstruct a 12-character Medium email-login token, which they could then use to access the victim’s Medium account.

The Gmail-connected AI attack followed a different chain. PortSwigger combined a Gmail image-proxy bypass with indirect prompt injection against Anthropic’s Cowork Gmail connector. The malicious email instructed Cowork to locate token-bearing content and incorporate it into an HTML draft; when the victim subsequently opened that draft, a CSS image-set() request could transmit the Slack token to an external server.

The Hexnode Solution

Hexnode UEM can help reduce exposure by enforcing device security baselines, OS and software update policies, application controls, and compliance requirements on managed endpoints used to access webmail and SaaS applications. While CSS webmail vulnerabilities exploit in-browser rendering engines, Hexnode serves as a defense-in-depth safety net at the device and identity boundary, helping limit the broader risk posed by compromised or non-compliant endpoints. Its compliance framework can evaluate factors such as encryption, password-policy adherence, required or blocklisted applications, and device integrity.

Hexnode XDR complements these controls by delivering host-level threat detection and rapid response. If a webmail or browser exploit attempts post-compromise payload execution or unauthorized process spawning, security teams can leverage Hexnode XDR to quarantine malicious files, kill compromised processes, and isolate affected endpoints to prevent lateral movement.

For identity-driven access control, Hexnode UEM can integrate with Microsoft Entra ID by sharing managed-device compliance status with Entra ID, where that status can be evaluated as part of Conditional Access decisions. Organizations can then configure Conditional Access policies to grant access to protected corporate resources only when devices managed and evaluated by Hexnode meet defined compliance requirements, reducing reliance on credentials alone as the access boundary.

Feature Resource

Becoming a UEM blackbelt

Explore how Hexnode helps you master UEM—one belt at a time, from enrollment to automation.

Get the infographic

Conclusion

The PortSwigger research shows why enterprise email security cannot stop at message filtering. When untrusted email content can interact with trusted webmail interfaces, browsers, identity workflows, or AI-connected tools, the attack surface extends beyond the inbox itself.

Enterprises should take a layered approach that combines browser and endpoint hardening, device compliance, identity-aware access controls, AI connector governance, and continuous endpoint threat monitoring. The objective is to reduce the opportunities for a malicious message to turn an initial webmail weakness into credential theft, token exposure, or broader account compromise.