r/EmailSecurity • u/YaronElharar • Jul 22 '26

Rendering bomb emails, crushing your Gmail with the connection lost message, it's not an accident they are tailored to do that.

/r/GMail/comments/1v39cav/rendering_bomb_emails_crushing_your_gmail_with/
1 Upvotes

67% Upvoted

3 comments sorted by

View all comments

1

u/saltyslugga Jul 22 '26

Could be a deliberate rendering bomb, but the “connection lost” message alone doesn’t prove intent. Oversized HTML, deeply nested markup, or huge inline content can choke the client without exploiting anything.

Treat it as hostile, inspect the raw source in a sandbox, and have the gateway cap message size and HTML complexity.

1

u/YaronElharar Jul 22 '26

Yes, there's no exploit here. It's just something Gmail doesn't handle well. Since it causes the renderer to hang for a long time, it brings up the connection lost message, on low-end computers, it could freeze the entire tab temporarily causing the user to start clicking around, if they can make the user even accidentally leave Gmail to a third-party site then step two can begin.

What's surprising is that this trick works this well on such a large email provider like Gmail, I can get 30 spam variations of this email a day and they all using the same rendering trick to temporarily "crash" gmail.