Security researchers have discovered new CSS-based attack vectors that allow malicious content within emails to break out of message boundaries and interact with webmail interfaces. These attacks affect major email providers including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, enabling threat actors to steal passwords, hijack accounts, leak authentication tokens, and manipula
New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. PortSwigger researcher Gareth
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
