CSS Tricks Let Attackers Hijack Webmail, Steal Tokens and Passwords
Researchers show how crafted CSS inside email can break out of webmail sanitizers, letting attackers exfiltrate session tokens, hijack accounts and even steal passwords across Outlook, Gmail, Fastmail, ProtonMail, Yahoo and AOL. The findings force mail providers to rethink HTML/CSS isolation and tighten UI‑level defenses.