The PortSwigger security researcher Gareth Heyes presented CSS attacks at the Black Hat conference in Las Vegas that compromise passwords, access tokens, and even an AI mailbox assistant – all without JavaScript. Six major webmail providers are affected: Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. According to Heyes, central vulnerabilities remain open at Microsoft and Google.
CSS disguises keystrokes as a harmless dropdown menu
At the center of the presentation is an attack chain against Outlook in combination with the Firefox browser. Heyes uses an old CSS trick: a dropdown menu with adjacent options responds to a specific CSS selector, revealing which key was pressed last. Firefox resets an animation every 0.5 milliseconds, allowing keystrokes to be logged almost in real time. Through another CSS property, the field additionally disguises itself as a regular password field, so victims do not become suspicious. The chain begins with an email that bypasses the web interface’s sanitizer via CSS mutation: browsers convert hidden escape characters into regular CSS syntax when reading them back from the document model, allowing properties that are actually filtered out to leave the message window. In the end, the chain displays a fake Microsoft login screen that sends the entered password directly to a server controlled by the attackers. According to Heyes, this Outlook vulnerability still worked at the time of publication. The method is attractive for attackers because it combines only officially specified CSS properties and does not require a separately reportable software vulnerability – classic antivirus or spam filters barely catch it.
A paste race exposes access tokens at Yahoo, AOL, and Fastmail
A second chain concerns Yahoo Mail and AOL Mail and targets login tokens from the Medium platform. If an affected person pastes clipboard content into an email draft field, a brief time window opens in which embedded CSS runs despite filtering. Nested CSS attribute selectors check individual character strings of the twelve-character hex token from the start and end and reconstruct it from the overlaps – in the end, the attacking side can log in to Medium as the victim. At Fastmail, Heyes and his colleague Pete Hendy used a similar workaround via an image-proxy function to detect when an email was opened. Fastmail reportedly responded fastest, according to Heyes: the company closed two reported CSS mutation bugs and paid a $1,000 bounty for each finding. The technique can in principle be applied to any service that embeds login tokens directly in a callable web address, not just Medium – how many other platforms could be affected remains independently unverified.
AI mailbox assistant Cowork forwards a stolen Slack token
The chain Heyes considers most alarming targets Gmail in combination with Cowork, an AI-powered mailbox assistant with Gmail integration that searches emails and drafts replies. An email disguises a hidden instruction as a harmless CTF exercise and prompts Cowork to search the inbox for a confirmation code – in reality, the assistant grabs an access token for the messaging app Slack. The token ends up in a reply draft via an image address with a CSS fallback variable; once the user opens that draft, the browser loads the background image and sends the token unnoticed to a server controlled by the attackers. A security firm had already highlighted similar zero-click risks in several AI browsers. According to Heyes, Google rejected the underlying image-proxy bug; it still worked at the time of publication on August 6th. Proton Mail also initially dismissed a comparable report as not a bug, but quietly closed the flaw several months later without any public announcement.
Whether Microsoft and Google will close the remaining CSS vulnerabilities before a first real-world wave of attacks, or whether security teams will keep relying on user behavior such as clipboard pasting as an emergency brake, remains open. The case also points to a growing pattern: content that stays invisible to humans but gets read by AI assistants opens an additional attack path that classic phishing filters do not catch.
