Back Feeds.4Sysops

CSS attacks still break webmail defenses and steal passwords, tokens

Feeds.4Sysops •IT News • August 9, 2026

CSS attacks against Outlook, Gmail, Fastmail, Yahoo Mail, AOL Mail, and other webmail services can cross the boundary between an email and the trusted inbox interface. Public proof-of-concept attacks demonstrated password capture, session-token theft, UI hijacking, and manipulation of AI tools connected to email. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CSS Attacks Exploit Webmail Vulnerabilities to Steal Credentials A new class of attacks, termed 'CSS bomb' attacks, have emerged, exploiting CSS styling code in webmail services like Outlook, Gmail, and Yahoo Mail. These attacks can hijack user sessions, spy on activities, and steal passwords without the need for JavaScript or traditional malware. Researchers have demonstrated that these attacks can manipulate AI tools connected to users' inboxes, posing a significant risk to user security. The vulnerabilities affect major webmail platforms, allowing attackers to cross the boundary between emails and trusted inbox interfaces. Public proof-of-concept attacks have confirmed the ability to capture passwords and session tokens. As of now, no specific patches or mitigations have been detailed in the articles, highlighting an urgent need for webmail services to address these vulnerabilities. 5 sources 63

Extracted Entities

CSS attacks still break webmail defenses and steal passwords, tokens

The full story

Extracted Entities

Attack Types (1)

Companies (4)

Tools (1)