PortSwigger研究员Gareth Heyes发布了详细的安全研究论文，揭示了通过CSS和HTML漏洞突破Yahoo Mail、AOL Mail、Fastmail、ProtonMail、Gmail和Outlook等主流邮件客户端信任边界的多种攻击方式[1]。这些漏洞涵盖令牌窃取、UI欺骗和密码窃取等多个攻击维度，利用了允许列表CSS属性滥用、CSS清理器绕过、CSSOM变异以及CSS小工具等技术手段实现[1]。
研究中展示的具体攻击方法包括：通过嵌套属性选择器窃取12字符十六进制令牌（如Medium登录令牌）；使用CSS的:before和:after伪元素隐藏文本以执行间接提示注入攻击；利用label标签的for属性在Outlook中控制UI元素（该漏洞至今未被修复）；通过CSS hotwiring技术拦截页面上的所有点击并执行预期外的UI操作[1]。此外，研究员还构建了实时密码键盘记录器，利用CSS小工具突破Outlook的CSS清理器限制，并通过CSS属性选择器和字体高度预言绕过图像代理以追踪邮件打开[1]。
研究发现Firefox浏览器比Chrome和Safari更容易受到基于剪贴板的CSS注入攻击[1]。在漏洞修复方面，Fastmail使用的两个安全漏洞各获得$1000赏金奖励[1]。
Gareth Heyes, a researcher at PortSwigger, has published a comprehensive security study detailing how CSS and HTML vulnerabilities can compromise the trust boundaries of major email clients, including Yahoo Mail, AOL Mail, Fastmail, ProtonMail, Gmail, and Outlook [1]. The research demonstrates multiple attack vectors ranging from token theft to UI deception and password harvesting, exploiting weaknesses in CSS allowlists, CSS sanitizer bypasses, CSSOM mutations, and CSS gadgets [1].
Among the disclosed vulnerabilities, Fastmail has awarded $1,000 bounties for each of two bugs identified in its platform [1]. The research reveals that nested attribute selectors can be weaponized to steal 12-character hexadecimal tokens, such as Medium login credentials, while CSS :before and :after pseudo-elements can hide text to execute indirect prompt injection attacks [1]. In Outlook, the label tag's for attribute can be exploited to control UI elements—a flaw that remains unfixed to date [1]. Additionally, a technique called CSS hotwiring allows attackers to intercept all clicks on a page and trigger unintended UI operations [1].
The study further demonstrates the construction of a real-time password keystroke logger using CSS gadgets to circumvent Outlook's CSS sanitization defenses [1]. Researchers also discovered that CSS attribute selectors combined with font height prediction can bypass image proxies and track when emails are opened [1]. Browser variations present differing risk profiles, with Firefox proving more susceptible to clipboard-based CSS injection attacks than Chrome and Safari [1].