Why webmail is a weak choice for email security

Webmail is convenient, but it puts your whole mailbox inside the browser, the busiest and most attacked program on your computer, next to every extension and every web page you open. Attackers around the world have used flaws in popular webmail software to read and steal mail just by sending a crafted message. A desktop mail app such as Thunderbird, with OpenPGP encryption built in, gives you a smaller target and keeps your keys out of the browser. Use webmail when you must, and secure it properly when you do.

How webmail is attacked

Flaws in the webmail software

Webmail is a web application, and web applications have flaws. The US Cybersecurity and Infrastructure Security Agency (CISA) lists at least eleven flaws in Roundcube, one of the most widely deployed open-source webmail programs, as exploited in the wild, the latest added in February 2026. Its catalogue also lists flaws in other webmail products, such as Zimbra.

Several of these were cross-site scripting flaws: a specially crafted email ran code in the browser as soon as it was opened. The security company ESET reported in 2023 that one Roundcube flaw was used before a fix existed, against servers that were fully up to date. In 2025 ESET described a campaign against several webmail products in which the attackers stole passwords, contacts and messages, and added rules forwarding every incoming email to themselves. On one product they stole the two-factor secret and created an app password, so they kept access without needing the code.

The victims were spread across the world, from government offices in Africa to targets in South America. Webmail flaws get fixed quickly, and the attacks succeed mostly where servers are not updated in time. But a fix can only follow a flaw.

The browser itself

Everything webmail does happens in the browser, which brings the browser's risks with it:

• Stolen sessions. Google explains that malware which steals browser cookies bypasses two-factor sign-in, and that stolen cookies keep working after the malware is removed. A webmail session is one of those cookies.
• Extensions. Chrome's developer documentation shows that an extension with permission for a site can read that site's cookies. Every extension with broad access can, in principle, see your webmail.
• Fake login pages. A convincing copy of your webmail login is easy to build, and browsers can be tricked into autofilling saved passwords into hidden fields, which ESET saw in the 2025 campaign.

Encryption in a web page

The World Wide Web Consortium's (W3C) Web Cryptography specification notes that script injected into a web page is the equivalent of running code on the application, and can take keys or data. Encryption done by the webmail page itself is only as safe as the page. That is why browser-based encryption tools such as Mailvelope keep keys inside the extension rather than the page. Even so, Mailvelope says it is only as secure as your browser.

Why a desktop mail app is stronger

A desktop app such as Thunderbird connects to your mailbox directly over IMAP and SMTP:

• A smaller target. It does not share a process with every website you visit or with browser extensions.
• Encryption built in. Thunderbird has had OpenPGP built in since version 78, released in July 2020, with keys kept in the app and protected by a Primary Password.
• Your own copy of your mail. Messages can be kept on your computer, so you are not dependent on a browser session to read them.
• One way of signing in. Mail apps use the mailbox password or an app password, without a web login page to imitate.

A desktop app is not immune. A computer infected with malware can read anything you can read, in any app. But the app removes the risks that belong to the browser alone.

Our help article Why and how to switch to Thunderbird covers moving across.

Securing webmail anyway

Webmail still has a place, for example on a trusted second computer or while travelling. When you use it:

1. Add a second factor at sign-in where your provider offers it, and choose a security key or authenticator app over SMS. Security keys and authenticator apps are far harder to phish than text-message codes.
2. Encrypt sensitive messages with Mailvelope, which keeps your keys in the browser extension and away from the mail server. See How to encrypt webmail with Mailvelope and OpenPGP.
3. Sign out when you finish, rather than closing the tab.
4. Never use webmail on a shared or public computer. The UK National Cyber Security Centre advises never saving passwords in the browser on shared devices.
5. Keep the browser updated and its extensions few.
6. Type the webmail address yourself or use a bookmark, never a link in an email.
7. Check your filters and forwarding now and then, because a hidden forwarding rule is the first thing an attacker adds.

Where Noiz fits

Every Noiz hosting plan includes webmail and IMAP, and Noiz keeps the webmail software on its servers updated. Noiz recommends Thunderbird with OpenPGP for everyday mail and webmail as the backup.

For an organisation that wants two-factor sign-in for its users, webmail included, Noiz runs Private Email on Mailcow, on a server for your organisation alone. Ask us for a quote.

Sources

• CISA, Known Exploited Vulnerabilities catalogue: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Roundcube, security updates 1.6.11 and 1.5.10 (1 June 2025): https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10
• Roundcube, security updates 1.6.8 and 1.5.8 (4 August 2024): https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
• ESET, Winter Vivern exploits zero-day vulnerability in Roundcube (25 October 2023): https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/
• ESET, Operation RoundPress (May 2025): https://www.welivesecurity.com/en/eset-research/operation-roundpress/
• Google Threat Analysis Group, Zimbra zero-day: https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/
• Google, fighting cookie theft using device-bound sessions (2 April 2024): https://blog.google/chromium/fighting-cookie-theft-using-device/
• Chrome for Developers, cookies API for extensions: https://developer.chrome.com/docs/extensions/reference/api/cookies
• W3C, Web Cryptography API: https://www.w3.org/TR/WebCryptoAPI/
• OWASP, Session Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
• Mailvelope FAQ: https://www.mailvelope.com/en/faq
• Thunderbird 78.0 release notes: https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/
• NCSC, password managers: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/password-managers

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.