New research shows content inside an email can escape its message boundary and interfere with the webmail interface. A Yahoo/AOL paste race can expose a Medium email-login token and let an attacker sign in as the victim. For webmail providers, the paper recommends isolating HTML email in sandboxed iframes and tightly restricting CSS, custom attributes, select menus, and image requests. Given style injection and a numeric token rendered as text in the email, CSS can determine which digits occur and how often, hide non-matching links, and leave the matching link across the page. Other findings include Fastmail "CSS hotwiring," which can redirect clicks into unintended and multi-step UI actions.