The vulnerability involves Proton Mail's web interface displaying the From display name prominently without forcing the actual envelope sender address into view. An attacker can craft a display name containing an address-shaped string on a look-alike domain (e.g., gmaiI.com with a capital 'I' instead of an 'l'), which renders identically to the legitimate domain in the default macOS system font (SF Pro). Proton Mail's protections against encoding-based homographs do not cover this font-based homograph. Additionally, Proton Mail does not show an authentication-failure banner for messages from domains lacking DMARC records, even if SPF fails, resulting in spoofed messages delivered to the inbox without warning. A Reply-To header can redirect replies to an attacker-controlled address without visibility unless the user inspects headers manually. The issue was reported in February 2025, confirmed and bounty awarded in April 2025, but remains unpatched as of September 2026. Proton acknowledged the risk and promised a fix but has not shipped one, and the researcher publicly disclosed the issue after Proton did not act within the disclosure policy timeframe.

Attackers can send emails that appear to come from legitimate senders by exploiting visual homographs in the display name, potentially deceiving users into trusting and acting on spoofed messages. The lack of authentication-failure warnings for domains without DMARC records increases the risk of successful phishing or social engineering attacks. Replies to such spoofed emails can be redirected to attacker-controlled addresses without user awareness. This undermines user trust in Proton Mail's sender identity verification and could facilitate targeted impersonation attacks.

As of the latest information, no official fix has been released by Proton Mail despite the issue being confirmed and a bounty awarded. Users should exercise caution when verifying sender identities, especially if the sender domain lacks a DMARC record. Proton Mail users and administrators should monitor official Proton communications for updates. Patch status is not yet confirmed — check the vendor advisory or Proton Mail's official channels for current remediation guidance.