Proton Exploit (2027)

In most scenarios, the attack only worked if the victim viewed both emails and clicked a specific link in the second one.

Shift the tone (e.g., for developers or simpler for general users).

The Sonar Research team identified the vulnerability during a routine audit of Proton's open-source repositories. The issue stemmed from how the web application handled user-controlled HTML. While senders need the ability to style messages, failing to properly sanitize certain tags can allow malicious tags to execute in a reader's browser. How the Exploit Worked Proton Exploit

Proton Mail XSS Vulnerability: A Deep Dive into the 2022 Exploit

The vulnerability was strictly limited to the web interface; non-web Proton Mail apps (iOS/Android) were never affected. Protecting Your Data In most scenarios, the attack only worked if

Ensure you are using the latest version of any Proton applications.

An attacker would need to send two carefully crafted emails to the target. The issue stemmed from how the web application

After researchers disclosed the bug in June 2022, Proton developed and deployed a fix by early July 2022.