> TritonInfoSec News
Home / Aug 09, 2026 / Story
0
#1 The Hacker News general August 08, 2026 at 08:03 UTC

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

By [email protected] (The Hacker News)

AI Summary

PortSwigger researcher Gareth Hayes demonstrated CSS-based attack chains affecting Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail that allow email content to escape message boundaries and interfere with the webmail UI. The techniques can capture passwords, steal session tokens, hijack trusted UI actions, and manipulate AI tools that parse email — making this a broad, high-impact finding for anyone operating or securing webmail infrastructure.

Read full article → https://thehackernews.com/2026/08/new-css-attacks-…

Relevance score: 88.0/100

# More from August 09

  1. 2
    Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication The Hacker News
  2. 3
    Progress Kemp LoadMaster Flaw Hits CISA KEV After 792 Reported Exploit Attempts The Hacker News
  3. 4
    N-able Issues N-central Hotfix 2 as Attackers Reach Managed Systems and Persist The Hacker News
  4. 5
    New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables The Hacker News
  5. 6
    Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails The Hacker News
  6. 7
    Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer The Hacker News
  7. 8
    TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign The Hacker News
  8. 9
    North Carolina Ports confirms cyberattack disrupting operations BleepingComputer
  9. 10
    Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access The Hacker News