Executive Summary
Researcher Gareth Heyes (PortSwigger) has unveiled a series of novel techniques dubbed 'CSS: the bomb inside your inbox' that weaponize sanitized CSS within webmail environments. The research demonstrates that even when webmail providers like Outlook, Gmail, and Fastmail attempt to sanitize HTML/CSS, discrepancies in browser parsing and the CSS Object Model (CSSOM) allow for high-impact exploitation.
The attack chain involves bypassing CSS sanitizers to inject malicious styles that can exfiltrate sensitive tokens from text nodes, intercept UI clicks (CSS Hotwiring), and create real-time keyloggers. Key findings include 'CSS Gadgets' in Outlook that enable full-page defacement and credential theft by abusing allowed custom data attributes and browser-specific behavior in Firefox and Chrome to bypass input timing restrictions.
This research significantly elevates the risk profile of CSS injection from simple styling issues to a primary vector for account takeover and credential theft. Organizations relying on webmail should prioritize isolation via sandboxed iframes and restrict dangerous CSS pseudo-classes like :has(), :checked, and :focus.