Sender spoofing in Proton Mail via display-name homograph
A confirmed, bounty-awarded write-up of a Proton Mail vulnerability that lets an attacker present a forged sender identity indistinguishable from a real one in the web interface.
This is a security research write-up describing a confirmed, bounty-awarded vulnerability in Proton Mail's web interface: it can be made to show a forged sender identity that is visually indistinguishable from a legitimate one. The issue combines three weaknesses — an attacker-controlled display name can hold an address-shaped string that the interface surfaces where users read the sender's address; the interface's default system font renders capital I and lowercase l identically, so a look-alike domain reads as the real one; and no authentication-failure banner appears for a spoofed sender domain that publishes no DMARC record, even when SPF fails.
Combined with a Reply-To alias, a message can arrive in a Proton inbox appearing to come from a real, named person at a real domain with no visible cue that anything is wrong unless the header is expanded manually. The finding was reported to Proton Security in February 2025, confirmed and bounty-awarded in April 2025, reproduced end-to-end only against the reporter's own accounts, and still reproducible as of September 2026.
No unsolicited messages were sent to other Proton users during the research.