The Roundcube security update fixes 12 webmail flaws, including a zero-click stored XSS and an SSRF bypass. Update to 1.6.19 or 1.7.4 now.
Related Posts:
CVE-2026-86218 (CVSS 10): N-central Pre-Auth RCE Exploited in the Wild
MikroTrick PoC: RouterOS Admin Rights Exploited In Wild
AI Agent Coordination: The Unprecedented OpenAI Breakout
The post Roundcube Security Update Fixes 12 Webmail Flaws appeared first on Daily CyberSecurity.
Roundcube fixes a webmail RCE flaw and an SSRF filter bypass in versions 1.6.18 and 1.7.3. Update your mail server now.
Related Posts:
CVE-2026-19188: Haiwell HMI Gateway Flaw Lets Attackers Execute Arbitrary OS Commands With Root Privileges (CVSS 10.0)
Linux AF_PACKET Race (03390aa): PoC Exploit Enables Local Privilege Escalation
Citrix NetScaler Pre-Auth RCE CVE-2026-8452 Gets Public Exploit Code
The post Roundcube Patches RCE and SSRF Flaws in 1.6.18 and 1.7.3 appeared first on Daily Cyber
CSS attacks on major webmail services can steal credentials, hijack sessions and manipulate AI tools connected to users’ inboxes.
PortSwigger researcher Gareth Heyes demonstrated something that should make every webmail team a little nervous: plain CSS, the styling language that’s supposed to just make text look nice, can be weaponized to steal passwords, hijack sessions, and manipulate AI tools reading your inbox. The research covers real attack chains against Outlook, Gmail, Fastmail, Prot
CSS attacks on major webmail services can steal credentials, hijack sessions and manipulate AI tools connected to users’ inboxes.
PortSwigger researcher Gareth Heyes demonstrated something that should make every webmail team a little nervous: plain CSS, the styling language that’s supposed to just make text look nice, can be weaponized to steal passwords, hijack sessions, and manipulate AI tools reading your inbox. The research covers real attack chains against Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail.
The core idea is that email clients let HTML and CSS through with the assumption that styling can’t reach outside the message it’s attached to. Heyes found ways to break that assumption using two basic approaches: abusing CSS features webmail already permits, or exploiting a gap between what a content sanitizer thinks it approved and what the browser actually renders. Either route can let content inside an untrusted email interact with the trusted interface surrounding it.
“It’s quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization.” Heyes explains. “I looked at the various “allow listed” CSS properties and HTML. With the goal of abusing them to spoof UI actions, control browsers, take over accounts or steal tokens. I targeted Fastmail, OpenAI’s Atlas, Firefox, AOL Mail, Yahoo Mail and Outlook.”
The Outlook chain is the most alarming one to picture in action. Allowed label elements can trigger controls that live outside the email itself, and Outlook’s own JavaScript can turn sanitized custom attributes into new page elements carrying CSS that bypasses the sanitizer’s rules entirely. Heyes used this to disguise a dropdown menu as a password field, and because Firefox resets its roughly one-second selection timer whenever that dropdown moves offscreen, the attack captures whatever the victim types in something close to real time.
“A CSS gadget occurs when some existing JavaScript appends an element to the DOM with a CSS property or value outside the webmail CSS sanitizer allow list. We can use this to break out of trust boundaries.” continues the report.
“This is a real CSS gadget that I found on Outlook. Here Outlook “allow lists” custom data attributes. One of the libraries they use appends to the DOM with an element and CSS property value outside their allow list. In this case position:fixed which allows you to position an element anywhere on the page. Which breaks the trust boundaries of an email message. We can then use this gadget to break out of the message window and deface Outlook.”
Yahoo Mail and AOL Mail opened a different door, one involving something as mundane as copy and paste. In Firefox, HTML pasted into a draft can briefly keep its active styling before sanitization strips it out, and Heyes used that gap to leak a 12-character login token during a Medium sign-in flow, enough for an attacker’s server to reconstruct the token and log in as the victim.
“They have a login via email feature that produces a 12 character hex token. If you can obtain this token then you can login as the user. An attacker can just initiate this process with the victim’s email then create some CSS to copy to the clipboard, the victim then only needs to paste into a draft and then their token is stolen.” the researcher explains.
There’s also a clever workaround for cases where Content Security Policy blocks external resource requests entirely. Given the ability to inject styles and a numeric token displayed as plain text in an email, CSS alone can determine which digits appear and how often, then arrange links so a single click reveals that information to an attacker’s server. No JavaScript required, just careful use of selectors and visibility rules.
The AI-connected piece of this research is where things get genuinely unsettling. Gmail’s image-set() fallback could trigger an external request despite sanitization, and Heyes chained that into an indirect prompt-injection email processed by Anthropic’s Claude Cowork through a connected Gmail integration. The injected instructions caused it to retrieve the token and place it in an HTML draft; viewing the draft leaked it, exactly the kind of AI-agent trap that turns a normal “summarize my inbox” request into unintended data exposure. A separate demonstration against OpenAI’s Atlas browser used hidden CSS pseudo-elements to show a human harmless text while an AI model read a completely different, hidden instruction underneath.
Not every provider is equally exposed right now. Fastmail patched two CSS mutation bugs Heyes reported, and a Proton Mail proxy bypass stopped working when he retested it before publication. Outlook’s label-jacking trick and Gmail’s image-set() bypass, on the other hand, both still worked as of August 6, and the paper doesn’t confirm whether the full Outlook password-capture chain has been fixed at all.
Heyes and PortSwigger published proof-of-concept code publicly alongside the research, and their guidance for webmail providers is fairly specific: isolate HTML email inside sandboxed iframes, restrict CSS to strict character allow-lists, check for dangerous CSS gadgets before permitting custom attributes, and block image requests to anything outside an approved domain list. None of that is exotic advice, but it does mean rethinking how much trust gets extended to something as apparently harmless as a stylesheet.
Unit 42 details a Russian cyberespionage campaign targeting Zimbra webmail servers using JavaScript injection to steal credentials.
The post Russian Global Webmail Espionage appeared first on Unit 42.
Entrar
