---
id: 6141
title: "CSS:the bomb inside your inbox"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/css-the-bomb-inside-your-inbox"
published_at: "2026-08-06T22:00:00Z"
tags: ["ai-security", "browser-security", "data-exposure", "prompt-injection", "web-security", "email-security", "webmail", "css", "sanitization-bypass", "token-exfiltration"]
phying_url: "https://phying.com/item/6141"
lang: en
---

# CSS:the bomb inside your inbox

## Summary

PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2026-08-06T22:00:00Z
- **Original:** https://portswigger.net/research/css-the-bomb-inside-your-inbox
- **Phying News:** https://phying.com/item/6141