Gareth Heyes published research demonstrating how CSS vulnerabilities in major webmail clients allow attackers to break trust boundaries, exfiltrate tokens, compromise third-party sites, and steal passwords. Webmail providers including Yahoo Mail, AOL Mail, Fastmail, Proton Mail, Gmail, and Outlook render untrusted CSS in trusted UI contexts, relying on sanitization that can be bypassed.

Heyes abused allowed HTML labels to perform UI actions, finding a live bug in Outlook where `<label for="Ribbon Mode Toggle">` enables ribbon control and message pinning. In Fastmail, he exploited `:before`/`:after` pseudo-elements with opacity tricks to hide malicious prompts from victims while exposing them to OpenAI's Atlas AI browser, achieving indirect prompt injection that could open arbitrary tabs.

Further techniques include CSS mutation in Fastmail, CSS hotwiring, defacing Outlook via CSS gadgets, and exfiltrating tokens even when CSP blocks external resources. Image proxy bypasses enable tracking email views in Fastmail, Proton Mail, and Gmail, while combining proxy bypasses with prompt injection amplifies impact.

Defences remain limited; future attacks include HTML-only keyloggers and Chrome real-time keyloggers. The research highlights fundamental discrepancies between sanitizer logic and browser rendering.