importantSYS.SOURCE: The Hacker News• 2026-08-08T13:33:57+05:30

CSS-Based Webmail Vulnerabilities Enable Password and Token Theft via UI Manipulation

#css vulnerability #email security #credential theft #ai security #web security

New CSS-based attacks exploit webmail interfaces to steal credentials and tokens by manipulating UI elements and bypassing security measures, with proof-of-concept demonstrations across major email services. Researchers recommend sandboxing HTML emails and restricting CSS to mitigate risks.

New research shows content inside an email can escape its message boundary and interfere with the webmail interface.

Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email.

PortSwigger researcher Gareth

Read original article

*** END OF TRANSMISSION ***

> APPLE LAUNCHES DEVICE LEASING INITIATIVE FOR IPHONES AND ACCESSORIES > AMAZON'S NEW TEXAS DATA CENTER LINKED TO HIGH-EMISSION POWER PLANT > US CYBER COMMAND UNIT INVESTIGATES MULTIPLE SUICIDE DEATHS AMONG PERSONNEL > EUROPEAN SATELLITE SERVICE ENHANCES WILDFIRE TRACKING CAPABILITIES > DEEPMIND'S WEATHERNEXT AI MODEL ENHANCES CYCLONE FORECASTING ACCURACY > ATLASSIAN ROVO VULNERABILITY ALLOWS EXFILTRATION OF JIRA AND CONFLUENCE DATA VIA PROMPT INJECTION > CSS-BASED WEBMAIL VULNERABILITIES ENABLE PASSWORD AND TOKEN THEFT VIA UI MANIPULATION > DISCOVERY OF HARDWARE BACKDOOR IN VIA C3 X86 PROCESSORS > METABASE ZERO-DAY VULNERABILITY ENABLES UNAUTHENTICATED ADMIN ACCESS > N-ABLE RELEASES N-CENTRAL HOTFIX 2 TO ADDRESS EXPLOITED VULNERABILITY AND PERSISTENCE THREATS> APPLE LAUNCHES DEVICE LEASING INITIATIVE FOR IPHONES AND ACCESSORIES > AMAZON'S NEW TEXAS DATA CENTER LINKED TO HIGH-EMISSION POWER PLANT > US CYBER COMMAND UNIT INVESTIGATES MULTIPLE SUICIDE DEATHS AMONG PERSONNEL > EUROPEAN SATELLITE SERVICE ENHANCES WILDFIRE TRACKING CAPABILITIES > DEEPMIND'S WEATHERNEXT AI MODEL ENHANCES CYCLONE FORECASTING ACCURACY > ATLASSIAN ROVO VULNERABILITY ALLOWS EXFILTRATION OF JIRA AND CONFLUENCE DATA VIA PROMPT INJECTION > CSS-BASED WEBMAIL VULNERABILITIES ENABLE PASSWORD AND TOKEN THEFT VIA UI MANIPULATION > DISCOVERY OF HARDWARE BACKDOOR IN VIA C3 X86 PROCESSORS > METABASE ZERO-DAY VULNERABILITY ENABLES UNAUTHENTICATED ADMIN ACCESS > N-ABLE RELEASES N-CENTRAL HOTFIX 2 TO ADDRESS EXPLOITED VULNERABILITY AND PERSISTENCE THREATS