Summary
- PortSwigger tested major webmail services and demonstrated techniques that abuse permitted HTML and CSS rather than relying only on script execution.
- The research includes interface manipulation, token leakage, password-theft techniques, and weaknesses in individual webmail sanitisation controls.
- Email content could also influence what an AI-enabled browser perceived, joining a mature web-security problem to indirect prompt-injection risk.
New research from PortSwigger shows how long-running problems in the rendering of untrusted email content can cross modern browser and AI trust boundaries, allowing carefully constructed HTML and CSS to manipulate interfaces, expose information, and alter what an AI system perceives.
Researcher Gareth Heyes examined the sanitisation used by services including Yahoo Mail, AOL Mail, Fastmail, Proton Mail, Gmail, and Outlook. Webmail applications need to display externally supplied HTML while preventing that content from controlling the surrounding trusted application, creating a difficult boundary between the message and the interface rendering it.
The research focuses on discrepancies between what sanitisation logic considers safe and what a browser eventually renders. PortSwigger demonstrated a range of techniques that rely on permitted HTML or CSS behaviour rather than straightforward arbitrary JavaScript execution.
In Outlook, Heyes found that permitted HTML labels could trigger controls in the surrounding interface. PortSwigger says one such technique could manipulate Outlook’s user interface directly from an email message and remained unfixed at publication.
Other parts of the research covered CSS-based information leakage, tracking through image-proxy behaviour, sanitiser bypasses, and techniques that could contribute to account or password theft under particular conditions. The affected services and exploitation requirements vary between individual findings.
The technical theme is familiar from web application security. Filtering untrusted content becomes difficult when the HTML parser, CSS engine, application JavaScript, and sanitiser do not interpret the same input in exactly the same way.
The newer element is AI. Heyes tested whether email content rendered in Fastmail could influence OpenAI’s Atlas browser and demonstrated a difference between what the human user saw and what the AI system processed when interacting with the message.
That creates an indirect prompt-injection route. An apparently ordinary email can expose machine-readable content that is not presented to the user in the same way, allowing an AI system to receive instructions or context that the person did not knowingly provide.
The mechanism does not make every HTML email an AI compromise. Its significance comes from the collision between two trust systems. Webmail providers have spent decades attempting to render hostile internet content safely inside privileged applications, while AI browsers and assistants increasingly consume the rendered result as an input for additional actions.
A discrepancy that once ended with interface spoofing or information leakage can acquire another consequence when an agent interprets the page and acts on what it sees. The browser is no longer only rendering content for a person; it can also become an observation layer for software capable of translating webpage or email content into subsequent tasks.
That changes assumptions around ostensibly passive material. Email has always been attacker-controlled input, but the user was historically its principal interpreter. Agentic browsing introduces another interpreter with different perception and, potentially, much broader ability to take action.
PortSwigger’s findings should not be read as one universal vulnerability affecting every mail provider in the same way. The techniques differ between services, and the disclosure and remediation status of individual findings varies.
Nor is the research a report of widespread malicious exploitation. It is vulnerability research published around Black Hat and DEF CON, showing possible attack techniques and security-boundary failures rather than documenting an active campaign against webmail users.
The architectural issue extends beyond the individual bugs. As browsers and enterprise applications add AI features that read webpages, email, and collaboration content on behalf of users, content-sanitisation boundaries increasingly need to account for machine perception as well as human perception.
A message can therefore look benign to the person opening it while presenting a different instruction surface to software processing the same page. That connects an old web-security problem to a much newer agent-security boundary.
