New CSS Attacks Can Bypass Webmail Defenses to Steal Passwords and Tokens

New research presented at Black Hat USA 2026 reveals critical CSS-based attacks that can break webmail defenses across platforms like Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. These techniques can capture passwords, hijack UI actions, and manipulate AI tools that read email, demonstrating how content inside an email can escape its message boundary and interfere with the webmail interface.