According to recent research, content within the mail could breach its message boundaries and affect the functionality of the webmail platform itself.
Through various attack chains that cover such popular email providers as Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques could be used to steal credentials, compromise third-party accounts, extract tokens, and manipulate AI applications for reading emails.
PortSwigger researcher Gareth Heyes presented the work at Black Hat USA 2026. The email UI escape attacks represent a significant class of vulnerabilities where untrusted content crosses the boundary between an email and its interface.
Let me walk through the email UI escape attacks, what they target, and what they can achieve.
The Attack Vectors
The email UI escape attacks follow two main paths. The first abuses HTML and CSS that webmail already allows. The second creates a discrepancy between what a sanitizer approves and what the browser or application ultimately creates. Both can cross the boundary between an untrusted message and its trusted interface.
The paper presents proof-of-concept research and does not report malicious exploitation. Public PoCs remain available as of August 8. The email UI escape attacks have been demonstrated across major webmail providers including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.
The Outlook and Firefox Password Capture Chain
One Outlook and Firefox chain in the email UI escape attacks spoofs a Microsoft sign-in screen and captures the password a recipient types. The chain shows how pieces can combine to create a convincing attack.
Allowed label elements can trigger controls outside the message. Application JavaScript can turn sanitized custom attributes into new DOM nodes carrying CSS outside the sanitizer's allow list. A media-query parsing trick then gave the attacker arbitrary CSS.
The email UI escape attacks chain disguises a select element as a password field. Firefox resets its roughly one-second option-selection timer when the select moves offscreen, making capture real-time.
The paper does not state whether the full Outlook password-capture chain was fixed. This uncertainty means Outlook users should be cautious.
The Yahoo and AOL Paste Race
Yahoo Mail and AOL Mail exposed a different route in the email UI escape attacks. In Firefox, pasted HTML could briefly retain active CSS before sanitization.
In the Medium demonstration, the attacker initiates an email-login flow. The victim copies attacker-supplied CSS to the clipboard and then pastes it into a Yahoo or AOL draft. The resulting requests reveal enough of the 12-character login token for the attacker's server to reconstruct it. The token can then be used to sign in as the victim.
This email UI escape attacks technique is particularly clever because it abuses the clipboard and paste functionality. The victim does not need to click a malicious link or download anything. They simply paste content into an email.
The Gmail and Cowork Slack Token Theft
A Gmail and Cowork chain in the email UI escape attacks can exfiltrate a Slack token after prompt injection and user interaction. Gmail's image-set() fallback could make an external request despite sanitization.
Heyes and PortSwigger colleague Pete Hendy chained it to an indirect prompt-injection email processed by Anthropic's Claude Cowork through a connected Gmail connector. In the demonstrated setup, after the attacker triggered a Slack token confirmation email and the victim asked Cowork to process the emails, the injected instructions caused it to retrieve the token and place it in an HTML draft. Viewing the draft leaked it.
This email UI escape attacks chain demonstrates the risks of AI tools connected to email. The AI tool follows instructions that may be hidden in emails, leading to token exposure.
The Fastmail CSS Hotwiring
A Fastmail demonstration in the email UI escape attacks targeted OpenAI's Atlas AI browser. CSS pseudo-elements and opacity made the human see harmless text while the model read hidden instructions.
When the user asked Atlas to translate the visible text, the hidden prompt caused it to open tabs and encode the victim's name in URL fragments. OpenAI is deprecating Atlas and says it is scheduled to stop working on August 9, 2026.
Other Fastmail findings in the email UI escape attacks include "CSS hotwiring," which can redirect clicks into unintended and multi-step UI actions. An escaped-backslash Fastmail image-proxy bypass relies on an allow-listed user.fm domain to reveal when an email is viewed.
Fastmail fixed two CSS mutation bugs. The researcher said the Proton Mail proxy bypass stopped working when he retested it.
The Proton Mail IP Address Leak
Heyes separately demonstrated a Proton Mail vector in the email UI escape attacks that exposed the recipient's IP address. Proton's current tracker-protection documentation says the service is designed to hide a user's personal IP address and exact email-open time.
The email UI escape attacks finding contradicts Proton's stated privacy guarantees. The IP address leak means that even Proton Mail users may be exposed to tracking.
The Click-Based Exfiltration Technique
The email UI escape attacks paper introduces a click-based exfiltration technique for cases where Content Security Policy blocks external resources. Given style injection and a numeric token rendered as text in the email, CSS can determine which digits occur and how often.
The technique hides non-matching links and leaves the matching link across the page. A victim click sends the digits and their frequency to the attacker's server. This allows exfiltration even when CSP is present.
AI-Connected Email as an Attack Vector
The email UI escape attacks research shows that AI-connected email creates another route for compromise. The Gmail and Cowork chain and the Fastmail and Atlas chain both demonstrate how AI tools can be manipulated through email content.
The injected instructions cause the AI to perform actions that leak sensitive information. This represents a new class of email UI escape attacks that targets not just the user but the AI tools they use.
Recommendations for Defenders
The email UI escape attacks research provides specific defensive guidance for webmail providers.
The recommendations include:
- Isolate HTML email in sandboxed iframes
- Tightly restrict CSS, custom attributes, select menus, and image requests
- Use character allow lists for CSS validation
- Check for CSS gadgets before allowing custom attributes
- Block select menus and dangerous selectors
- Prevent attacker-controlled image requests and allow-listed domains
The defensive guidance starts with strict isolation, then moves to more specific controls.
Wrapping It Up
The email UI escape attacks research demonstrates that content inside an email can escape its message boundary and interfere with webmail interfaces. The techniques capture passwords, take over third-party accounts, leak tokens, hijack UI actions, and manipulate AI tools.
Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail are all affected by various email UI escape attacks. Some have been fixed, but others remain unpatched.
The research is proof-of-concept and has not been reported in malicious exploitation. However, the public availability of PoCs makes the email UI escape attacks a significant concern.
Webmail providers should implement the recommended defenses. Users must be made aware of the dangers involved and take precautions while dealing with emails content.
FAQ Section
What are email UI escape attacks?
They are techniques where content inside an email escapes its message boundary and interferes with the webmail interface. The attacks can capture passwords, steal tokens, and manipulate AI tools.
Which webmail providers are affected?
Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail are all affected by various email UI escape attacks. Some vulnerabilities have been fixed, others remain unpatched.
How does the Outlook password capture work?
A chain of CSS tricks disguises a select element as a password field. Firefox resets the option-selection timer when the select moves offscreen, enabling real-time password capture.
Can AI email tools be manipulated?
Yes. Email user interface escape attacks show that AI tools connected to email can be exploited using prompt injection. The AI can be instructed to leak tokens or perform unauthorized actions.
What should defenders do?
Webmail providers should isolate HTML email in sandboxed iframes and tightly restrict CSS, custom attributes, select menus, and image requests. Users should be cautious about email content.
