Technology newsroom
Warning! New CSS Vulnerability in Popular Webmail Could Lead to Password and Sensitive Data Leaks 😱
Researchers from PortSwigger have discovered a new CSS-based attack technique that can bypass the security defenses of popular webmail services like Gmail and Outlook, potentially allowing hackers to steal user passwords and sensitive information.
📌 Key Takeaways:
- A new CSS-based attack technique has been discovered that can bypass the defenses of leading webmail services.
- This attack allows malicious email content to interfere with the main Webmail interface.
- Risks include password theft, token compromise, account takeover of other connected services, and UI spoofing to trick users into performing certain actions.
A new research paper by Gareth Heyes, a security researcher at PortSwigger, has revealed a worrying attack technique that can bypass the defenses of several major webmail services by exploiting vulnerabilities in how CSS (Cascading Style Sheets) is handled within emails.
Normally, when we open an email on Webmail, the email content is sandboxed to prevent it from interacting with other parts of the webpage for security reasons. However, this new technique demonstrates that specially crafted CSS code can "break out" of the email frame and affect the main webmail service page.
👾 Potential Impacts
This attack opens the door to several serious risks, including interception of passwords typed by users on login pages, theft of tokens for accessing other connected services, hijacking of trusted UI elements to trick users into unknowingly approving certain actions, or even controlling AI tools used to read and summarize email content.
📧 Affected Services
Based on the researchers' tests, this technique was effective against almost all popular webmail providers, including Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. This highlights a potentially overlooked security gap, even for providers with robust existing defenses.
💬 Which webmail service do you primarily use, and how concerned are you about this type of vulnerability?