Welcome to this Tekin Analysis intelligence report. The landmark research presented by PortSwigger senior security researcher Gareth Heyes at Black Hat USA 2026 has dismantled long-standing assumptions regarding email safety. Security teams previously assumed that stripping JavaScript rendered HTML emails safe. Heyes demonstrated that CSS can be independently weaponized to hijack webmail interfaces and log user credentials in real time.
Welcome to this Tekin Analysis intelligence report. The landmark research presented by PortSwigger senior security researcher Gareth Heyes at the Black Hat USA 2026 conference in Las Vegas has dismantled
long-standing cybersecurity assumptions regarding email safety. For decades, security teams operated under the assumption that stripping JavaScript tags (`<script>`) and blocking executable attachments
rendered HTML emails completely safe. Heyes demonstrated that standard Cascading Style Sheets (CSS) can be independently weaponized to hijack webmail interfaces, exfiltrate sensitive tokens, and log user
credentials in real time. In this technical teardown, Tekin Game deconstructs the underlying parsing discrepancies, real-time credential logging mechanisms, OAuth token exfiltration vectors, and the poisoning
of AI-assisted email workflows. Breaking Webmail Isolation: How CSS Escapes Sanitizer Boundaries Major webmail providers including Gmail, Outlook, Proton Mail, and Fastmail employ sophisticated HTML sanitizers
designed to scrub dangerous elements prior to rendering message content. However, Heyes's research exposed a fundamental architectural flaw: a widening gap between what sanitizers deem "safe" and how modern
browser layout engines interpret complex CSS specifications. By leveraging permitted CSS features—such as pseudo-classes, attribute selectors, and CSS mutations—attackers can construct payloads that escape
the designated email container, styling elements within the surrounding webmail interface and altering user interface controls. Primary vectors of CSS-based webmail exploits include: Repositioning permitted
Read Full Article