NewsPublished 28 Sep 2026

Sender spoofing in Proton Mail via display-name homograph

Source Reddit Cybersecurity

Discussion

A sender spoofing vulnerability in Proton Mail's web interface allows an attacker to forge the sender identity using display-name homographs that visually mimic legitimate email addresses. The issue exploits the font rendering of certain characters (e.g., capital 'I' vs lowercase 'l') in the default system font, making look-alike domains indistinguishable from real ones. Proton Mail does not display authentication failure warnings for domains without DMARC records, allowing spoofed messages to appear clean and trustworthy in the inbox. Despite reporting and a bounty awarded in early 2025, Proton has not fixed the issue as of September 2026.

r/cybersecurity (opens in a new tab)u/__ThePasanger__0 points0 comments

Proton Mail confirmed and paid for an email-spoofing bug, then left it unfixed for 16 months:
https://alonsovidales.github.io/protonmail-sender-spoofing/

Links cited in the discussion

https://alonsovidales.github.io/protonmail-sender-spoofing/

Impact

Attackers can send emails that appear to come from legitimate senders by exploiting visual homographs in the display name, potentially deceiving users into trusting and acting on spoofed messages. The lack of authentication-failure warnings for domains without DMARC records increases the risk of successful phishing or social engineering attacks. Replies to such spoofed emails can be redirected to attacker-controlled addresses without user awareness. This undermines user trust in Proton Mail's sender identity verification and could facilitate targeted impersonation attacks.

Defensive guidance

Users should exercise caution when verifying sender identities, especially if the sender domain lacks a DMARC record. Proton Mail users and administrators should monitor official Proton communications for updates.

Summary

The vulnerability involves Proton Mail's web interface displaying the From display name prominently without forcing the actual envelope sender address into view. An attacker can craft a display name containing an address-shaped string on a look-alike domain (e.g., gmaiI.com with a capital 'I' instead of an 'l'), which renders identically to the legitimate domain in the default macOS system font (SF Pro). Proton Mail's protections against encoding-based homographs do not cover this font-based homograph. Additionally, Proton Mail does not show an authentication-failure banner for messages from domains lacking DMARC records, even if SPF fails, resulting in spoofed messages delivered to the inbox without warning. A Reply-To header can redirect replies to an attacker-controlled address without visibility unless the user inspects headers manually. The issue was reported in February 2025, confirmed and bounty awarded in April 2025, but remains unpatched as of September 2026. Proton acknowledged the risk and promised a fix but has not shipped one, and the researcher publicly disclosed the issue after Proton did not act within the disclosure policy timeframe.

References

Community reviews

Loading reviews…

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 28 Sep 2026, 16:17 UTC

Technical details

References

Community reviews