Collected research

XSS in GMAIL Dynamic Email

XSS in GMAIL Dynamic Email (AMP for Email)

asdqw3 · Medium · 7 July 2026

Gmail's AMP for Email sanitizer could be escaped from inside a style amp-custom block: the parser acted on an unterminated closing style tag and auto-generated closing tags, letting injected markup break into the document body. Only a meta refresh survived the tag filter, navigating the mail view to a data URL; Gmail's CSP blocked script execution. Google paid a 6,000 dollar bounty.

Record

Document

XSS in GMAIL Dynamic Email (AMP for Email)

Researcher

asdqw3

Published by

Medium

Date

7 July 2026

Topic

XSS

In the archive

• Collected in the 2023 research round

Tags

• xss
• sanitizer-bypass
• email
• css
• parser-differential
• filter-bypass
• csp
• bug-bounty
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of asdqw3, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.