Malicious CSS Emails Can Hijack Webmail UI

How the attack worked

Research from PortSwigger examined how HTML and CSS embedded in emails can cross trust boundaries inside webmail clients. Because webmail clients often render untrusted CSS in trusted UI areas, and sanitization can be bypassed due to parsing discrepancies, attackers can manipulate interface elements that users assume are safe. One concrete example involved a real Outlook bug where HTML label elements inside an email could open the UI ribbon and pin the attacker's message, effectively letting the email content control parts of the mail client interface.

The research also described how attackers can hide content from a human reader while showing different content to an AI 'browser' or assistant feature. This creates a disparity between what the victim sees and what an AI feature processes, which can be used to manipulate AI-driven translation or summarization tools into taking unintended actions such as opening multiple tabs to attacker-controlled URLs.

A third technique involved clipboard behavior. Copying content from a webpage, such as a page showing a visitor's IP address, could carry hidden malicious CSS rather than plain text. When pasted into a webmail draft, this caused visible effects like a brief red flash in AOL and Yahoo Mail, pointing to a sanitization or race condition issue during paste handling.

Why it succeeded

These techniques succeeded because they exploit assumptions baked into everyday workflows: that clicking inside an email body is harmless, that AI assistants process content the same way a human does, and that pasted text is just text. None of the scenarios require a fake login page or urgent threatening language, which are the usual signals employees are trained to spot.

What to watch for

• Unexpected instructions to click inside an email message body, especially phrases like "click here" that aren't part of a normal mail client control
• Visual changes in the mail client, such as pinning, color flashes, or UI state changes, right after interacting with an email or pasting content
• Prompts encouraging use of an AI translate or summarize feature on content from an untrusted or foreign-language sender
• Requests to copy diagnostic-looking data, like an IP address, from a webpage into an email draft

Building resistance

Employees should treat unusual click-inside-the-email prompts as suspicious, particularly if they appear to affect the mail interface itself. Caution is warranted when using AI assistants to translate or summarize messages from unfamiliar senders, since indirect prompt engineering can trigger unintended actions like opening links. Finally, avoid copying and pasting content from unknown websites directly into email drafts or internal tools, since clipboard content can carry hidden HTML or CSS beyond visible text.

How can CSS in an email hijack a webmail interface?

Webmail clients sometimes render untrusted CSS in trusted UI areas, and sanitization can be bypassed due to parsing discrepancies, letting attacker-controlled styling influence how the interface behaves.

Can an email actually control Outlook's UI?

Yes, researchers found a real Outlook bug where HTML label elements in an email could trigger UI actions like opening the ribbon and pinning the attacker's message.

How does copy pasting content lead to a CSS attack?

Clipboard content copied from a webpage can carry hidden HTML or CSS rather than plain text, and pasting it into a webmail draft can trigger visible effects, which was observed in AOL and Yahoo Mail.

How can AI email assistants be manipulated by this technique?

Attackers can hide content from the human reader using CSS opacity while showing different content to an AI feature, enabling indirect prompt injection that causes the assistant to take unintended actions like opening tabs.