New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

New research shows content inside an email can escape its message boundary and interfere with the webmail interface. Across attack chains spanning Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail, the techniques can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. PortSwigger researcher Gareth

thehackernews.com ·7d ago

New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens

We haven't written up this one. The Hacker News has the full story — the link below goes straight to it.

Read the original at thehackernews.com →

More in Tech

Elderly woman duped of ₹1.91 lakh over ₹175 spoilt milk order complaint— How she fell prey to cyber fraud

A 63-year-old woman from Gujarat was scammed of ₹1.91 lakh over ₹175 rotten milk delivery. She contacted customer care helpline number which connected her to a fraudster impersonating a Zepto executive.

7d ago ·livemint.com

Is Meta an ‘intermediary’ or publisher as per IT rule? Govt questions its ‘what is shown to whom’ systems, paid content

The government reportedly questioned Meta's role, asking if it crosses into the role of a publisher by deciding “what content is shown to whom.”

7d ago ·livemint.com

Inside the Trump administration’s $2 billion push to build the world’s first useful quantum computer

The White House Quantum Summit brought together dozens of quantum policy officials and industry leaders last month, representing a rare glimmer of bipartisanship as the U.S. hustles to become the first nation to build a fault-tolerant quantum computer.

7d ago ·fastcompany.com

Processes and Threads in Operating Systems

Process In an Operating System, Any program that is currently in execution is called a Process. Every process has some unique attributes that allows the OS to control it. These attributes are stored inside a structure called the Process Control Block (PCB).

7d ago ·dev.to

innerHTML Has Five Doors. Most Reviews Only Watch One.

I have reviewed the same line of code, written five different ways, and caught it once. The line is element.innerHTML = something . I catch it when something is obviously a URL parameter. I miss it when something arrived four frames ago through a message event, got stored, and is written to the DOM by a function in a different file.

innerHTML can insert content into DOM
Risks XSS vulnerabilities with untrusted data
Developers often neglect validation and sanitization

7d ago ·dev.to

Google Cloud spells out its abuse-response ladder: throttle, isolate, suspend

Google Cloud published a security-team overview this week outlining how it detects and contains abuse across its shared infrastructure, and for engineers running pipelines on GCP the operational takeaway is the escalation ladder: throttle first, isolate the identity, suspend the project if nothing else holds.

7d ago ·dev.to