New CSS Attacks Bypass Webmail Defenses to Steal Passwords and Tokens

New research presented at Black Hat USA 2026 demonstrates CSS-based attacks that can break webmail defenses across platforms like Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. These techniques can capture passwords, hijack third-party accounts, leak tokens, and manipulate AI tools that read email. Public Proof-of-Concepts (PoCs) are available as of August 8.