CSS Alone Can Steal Your Email Password From Some Providers. We Tested bmail.

An email can now steal your password with no attachment and no JavaScript, using only the styling code that picks fonts and colors, and the full breakdown of what stops it is at https://s.vp.net/ti2EU.