New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

Researchers have discovered new CSS attacks that can breach webmail defenses, allowing attackers to steal sensitive information. These attacks can cause content within an email to interact with the webmail interface in unintended ways. The techniques can be used to capture passwords, take over third-party accounts, and leak tokens, among other malicious activities. The attacks have been found to be effective across multiple webmail services. The vulnerabilities can also be exploited to hijack trusted user interface actions and manipulate AI tools used to read email.