A newly disclosed vulnerability in major webmail platforms reveals that standard Cascading Style Sheets (CSS) can be weaponized to silently exfiltrate credentials and corrupt the data fed into automated inbox assistants. Disclosed on 9 August, the research from PortSwigger highlights a critical blind spot in how modern email clients and integrated AI tools process styling code.
Researcher Gareth Heyes demonstrated that malicious CSS payloads embedded within standard HTML emails can trigger unauthorized background requests, hijack active sessions, and alter the visual context presented to AI models. Unlike traditional phishing, this exploit executes passively the moment the email client renders the message, making the attack highly scalable and impossible to counter with user awareness alone.
The implications extend significantly beyond credential theft. As organizations deploy AI assistants to summarize correspondence and draft replies, the integrity of the AI's input pipeline becomes a primary attack surface. If a crafted CSS payload manipulates the Document Object Model (DOM) that an AI assistant reads, threat actors could force automated systems to generate fraudulent responses, leak sensitive data, or misclassify communications.
Security experts recommend a two-pronged architectural defense to counter this threat. First, email providers must implement strict CSS sanitization, treating all incoming styling as untrusted and stripping properties capable of network requests or DOM manipulation. Second, AI assistants must be isolated from the raw, styled DOM, processing only sanitized text representations of the email content. This separation breaks the attack chain by ensuring visual manipulations cannot alter the underlying data the AI consumes.
The research forces a shift in defensive posture: passive web standards like CSS must now be scrutinized with the same rigor as executable scripts. While the proof-of-concept targeted prominent webmail services, broader industry assessment is needed to protect all HTML-rendering applications. Security teams are evaluating the trade-offs of aggressive sanitization, particularly its impact on legitimate email formatting.
As AI adoption accelerates, developers must treat styling code as a potential execution vector. Implementing robust DOM isolation and rigorous input validation is essential to securing next-generation email automation.
一項針對主要網頁電郵平台的新披露漏洞顯示，標準的層疊樣式表（CSS）可被武器化，用於悄無聲息地竊取憑證並污染輸入至自動化收件箱助理的數據。於 8 月 9 日披露的這項研究來自 PortSwigger，揭示了現代電郵客戶端及整合的人工智能工具處理樣式代碼時的一個關鍵盲點。
研究員 Gareth Heyes 證實，嵌入在標準 HTML 電郵中的惡意 CSS 載荷，可觸發未經授權的背景請求、劫持現有會話，並更改呈現給人工智能模型的視覺情境。與傳統釣魚攻擊不同，這種漏洞利用在電郵客戶端渲染郵件時便會被動執行，使得攻擊具有高度擴散性，且僅憑用戶意識無法防禦。
其影響遠超單純的憑證盜取。隨著機構部署人工智能助理以摘要通訊並草擬回覆，人工智能輸入管道的完整性已成為首要攻擊面。若精心設計的 CSS 載荷操控了人工智能助理讀取的文件對象模型（DOM），威脅行為者便可能強迫自動化系統生成欺詐回覆、洩露敏感數據，或錯誤分類通訊內容。
安全專家建議採用雙管齊下的架構防禦來應對此威脅。首先，電郵服務商必須實施嚴格的 CSS 清理機制，將所有傳入的樣式視為不可信賴，並移除能觸發網絡請求或 DOM 操控的屬性。其次，人工智能助理必須與原始、帶樣式的 DOM 隔離處理，僅接收經過清理的郵件內容純文本表示。這種分離可打破攻擊鏈，確保視覺操縱無法影響人工智能消費的底層數據。
這項研究迫使防禦策略發生轉變：像 CSS 這類被動的網絡標準，如今必須以審視可執行腳本的同等嚴謹度進行監察。雖然概念驗證攻擊針對的是知名網頁電郵服務，但需要更全面的行業評估以保護所有 HTML 渲染應用程式。安全團隊正評估過度清理的權衡考量，特別是其對合法郵件格式的影響。
隨著人工智能應用加速普及，開發者必須將樣式代碼視為潛在的執行向量。實施穩健的 DOM 隔離及嚴格的輸入驗證，對於確保下一代電郵自動化的安全至關重要。