Cybersecurity researchers have identified a novel class of email-based attacks, termed “CSS bomb” attacks, that exploit Cascading Style Sheets (CSS) to compromise webmail interfaces. These attacks enable cybercriminals to monitor user activity and capture passwords in real time, all without the use of JavaScript or traditional malware.
By leveraging standard CSS styling code, attackers can transform a simple HTML email into a covert keylogger. This method capitalizes on the inherent trust in formatting features present in most major webmail platforms, allowing malicious emails to appear benign while executing harmful actions.
Mechanism of the Attack
Researchers, including Gareth Heyes from PortSwigger, have analyzed how webmail clients such as Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail sanitize incoming HTML and CSS content. These sanitization processes are designed to remove potentially dangerous code while preserving the intended appearance of emails. However, discrepancies between what these sanitizers deem safe and what browsers actually render create opportunities for exploitation.
Attackers exploit specific CSS features and quirks, such as CSS mutation, attribute selectors, and pseudo-elements like :before, :after, :has(), and :checked. By manipulating select-menu dropdowns to resemble password input fields, they can deceive users into entering their credentials. Each keystroke in these spoofed fields triggers unique CSS rules that send background image requests to servers controlled by the attackers, effectively logging every character typed.
Implications and Vulnerabilities
Previous CSS-based keylogging concepts were largely theoretical, as browsers typically do not update HTML attributes when users type into standard input fields. This new research circumvents that limitation by hijacking select elements and HTML labels, creating a fully functional, real-time password-stealing mechanism that operates even in emails protected by strict sanitizers like DOMPurify.
Demonstrations of these exploits have shown significant vulnerabilities across various platforms. For instance, in Outlook, a CSS “gadget” bug allowed attackers to escape the email window and present a convincing fake Microsoft login screen. In Fastmail, techniques like CSS hotwiring enabled attackers to hijack user clicks, leading to unintended actions, while other bugs permitted silent tracking of email openings.
Similar vulnerabilities were identified in Gmail and ProtonMail, where image-proxy bypasses were exploited. One proof-of-concept combined a Gmail vulnerability with AI browser prompt injection to exfiltrate Slack authentication tokens through an AI-powered email assistant.
Mitigation and Recommendations
These attacks, relying solely on CSS and HTML, can evade antivirus tools, spam filters, and script-blocking defenses that focus on JavaScript-based threats. Following responsible disclosures, several of these flaws have been patched. Fastmail, for example, has implemented fixes, though some issues, such as the Outlook label-hijacking bug, reportedly remain unresolved.
Security experts recommend that webmail providers take the following measures to mitigate such attacks:
- Render untrusted email content within sandboxed iframes.
- Block automatic image loading.
- Disallow risky CSS selectors like
:has()and:checked. - Restrict custom HTML attributes that could be exploited as sanitizer-bypass gadgets.
For individual users, practical defenses include disabling auto-loading of remote images and treating unexpected login prompts within emails with suspicion. These steps can serve as a first line of defense against this emerging threat.
The emergence of CSS bomb attacks underscores the evolving nature of cyber threats and the need for continuous vigilance. As attackers develop more sophisticated methods that exploit trusted web technologies, both service providers and users must adapt their security practices to stay ahead of potential vulnerabilities.
