HTML Injection in Email Clients: From Nuisance to Phishing
Email HTML is not a browser. Script tags die in most clients. That does not make markup injection useless — it makes the impact conversation different. You are usually proving phishing and UI redress inside a trusted sender identity, not classic cookie theft.
CWE-79 still applies when a webmail surface renders the same HTML. For mailbox apps (Gmail, Outlook, Apple Mail), frame the bug as HTML injection leading to brand abuse.
Where injection sneaks in
- Receipts and ticket threads that echo a subject or display name
- “Comment on shared doc” notifications with unescaped titles
- Password-reset or invite templates that interpolate user-controlled names
- Marketing preference centers that preview HTML unsafely on the web side
Header injection (SMTP CRLF) is a sibling issue — separate report if you can add Cc/From. Here the payload rides the HTML body.
Client reality checks
Try payloads that survive sanitizers:
- Nested tags broken across encoding (
<img src=x onerror=...>often stripped;<a href="https://evil">often kept) - CSS that relocates legitimate buttons (
positiontricks in clients that allow style blocks) - Homograph link text vs href mismatch
mailto:anddata:oddities where a client is outdated
Send to accounts you own on major clients. Screenshot Gmail vs Outlook — severity sometimes hinges on one renderer.
When programs pay
Strong: you control a full-screen phishing layout inside an email that still shows the real From domain/brand, with a convincing credential form lookalike and working links.
Medium: persistent markup breaking the template, injected tracking images to your server from other recipients’ opens (privacy), or XSS on the web archive of the same message.
Weak: italic text where it should be plain — skip or mark informational.
OWASP XSS pages help when the webmail path executes script; for pure clients, spell out social-engineering impact and any SPF/DKIM alignment that makes the mail “official.”
Safe testing
Only send to inboxes you control or that the program authorizes. Do not phish real customers. Redact recipient lists in attachments.
I stopped calling every <b> echo “XSS.” I call it HTML injection, show the phishing prototype, and let severity follow the client behavior I captured.