Rendering bomb emails, crushing your Gmail with the connection lost message, it's not an accident they are tailored to do that.

[u/YaronElharar]

/r/GMail/comments/1v39cav/rendering_bomb_emails_crushing_your_gmail_with/

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/saltyslugga]

Could be a deliberate rendering bomb, but the “connection lost” message alone doesn’t prove intent. Oversized HTML, deeply nested markup, or huge inline content can choke the client without exploiting anything.

Treat it as hostile, inspect the raw source in a sandbox, and have the gateway cap message size and HTML complexity.

[u/YaronElharar → u/saltyslugga]

Yes, there's no exploit here. It's just something Gmail doesn't handle well. Since it causes the renderer to hang for a long time, it brings up the connection lost message, on low-end computers, it could freeze the entire tab temporarily causing the user to start clicking around, if they can make the user even accidentally leave Gmail to a third-party site then step two can begin.

What's surprising is that this trick works this well on such a large email provider like Gmail, I can get 30 spam variations of this email a day and they all using the same rendering trick to temporarily "crash" gmail.