Exploiting CSS Vulnerabilities in Webmail Clients for Unauthorized Actions

The article details critical vulnerabilities in webmail clients' CSS sanitization that enable attackers to bypass security controls, exfiltrate sensitive data, and manipulate user interfaces. It demonstrates techniques for exploiting allowed HTML/CSS properties to perform account takeovers, AI prompt injection, and password theft across major email platforms.

Comments

Read original article