August 9, 2026
Inbox zero, trust zero
CSS: The bomb inside your inbox
Emails can secretly hijack what you click, and readers are yelling “just make it plain text already”
TLDR: A researcher says some email services can be tricked by hidden styling code, letting malicious messages mess with clicks and sensitive data. Commenters reacted with equal parts panic and sarcasm, with the loudest verdict being that rich, fancy email was a disastrous idea in the first place.
A security researcher basically walked into the comments section carrying a lit match: email messages, they argue, can smuggle in styling code that looks harmless but can mess with what people see, click, and even what outside tools understand. The paper name-drops huge inbox brands and claims everything from token theft to password stealing is on the table. But the real fireworks came from readers reacting with a mix of horror, sarcasm, and a very online kind of exhausted rage. One commenter deadpanned, “Oh that’s all, is it?” after the long victim list, which pretty much captured the mood: you mean all our inboxes are tiny haunted websites now?
The strongest hot take by far was the simple one: HTML email was a mistake. One commenter said allowing anything beyond plain text in email bodies was a terrible idea, and honestly, that became the unofficial slogan of the thread. Others pushed a more practical fix: lock emails inside heavily restricted boxes so they can’t poke at the rest of the page. That led to a mini-debate over whether strict isolation is the obvious solution or one of those “sounds easy, messy in real life” ideas. Meanwhile, the jokes kept flying, including a snarky swipe at the article page itself needing JavaScript “for an enhanced user experience.” In other words: readers weren’t just shocked by the inbox tricks — they were also roasting the entire modern web for making email feel like a booby-trapped app.
Key Points
- •The article argues that webmail clients can be vulnerable when they render untrusted CSS inside trusted UI and rely on sanitization to make it safe.
- •The author says research across Yahoo Mail, AOL Mail, Fastmail, ProtonMail, Gmail, and Outlook found parser discrepancies and sanitizer weak points.
- •A highlighted technique uses HTML `label` elements and the `for` attribute to trigger clicks on form controls, including an Outlook example that could open the ribbon and pin a message.
- •The article states that at least three webmail clients were vulnerable to label-based behavior and that the Outlook issue remained unfixed at the time described.
- •The article also describes using CSS pseudo-elements and opacity to create a difference between what a user sees and what an AI browser feature interprets, in an experiment involving Fastmail and OpenAI’s Atlas.